Renovatebot vulnerabilities

Products

• Renovate 25

Newest

• renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 more Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources CVE-2026-110868 8.4 HighOctober 14, 2026
• renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 more Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset CVE-2026-110867 9.0 CriticalOctober 14, 2026
• renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 more Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request CVE-2026-110866 5.3 MediumOctober 14, 2026
• renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 more Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets CVE-2026-110865 7.1 HighOctober 14, 2026
• renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 more Renovate before 44.14.7 Command Injection via distributionType CVE-2026-88889 8.5 HighSeptember 10, 2026
• renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 more Renovate before 44.14.7 Command Injection via Mix organization CVE-2026-88888 7.3 HighSeptember 10, 2026
• mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 more Renovate before 44.11.2 Credential Exfiltration via Link Header CVE-2026-88887 9.2 CriticalSeptember 10, 2026
• mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 more Renovate before 44.14.7 Command Injection via gradle-wrapper CVE-2026-88886 8.5 HighSeptember 10, 2026
• renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 more Renovate before 44.14.7 Command Injection via depName CVE-2026-88885 7.3 HighSeptember 10, 2026
• mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 more Renovate before 44.3.1 Authentication Bypass via Digest Updates CVE-2026-88884 6.9 MediumSeptember 10, 2026
• mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 more Renovate before 44.14.4 TLS Private Key Log Sanitisation CVE-2026-88883 8.3 HighSeptember 10, 2026
• mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 more Renovate before 44.11.2 Credential Exfiltration via Link Header CVE-2026-88882 9.2 CriticalSeptember 10, 2026
• mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 more Renovate before 44.11.3 Credential Exfiltration via Link Header CVE-2026-88881 9.2 CriticalSeptember 10, 2026
• renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 more Renovate before 44.11.3 Credential Exfiltration via Link Header CVE-2026-88880 9.2 CriticalSeptember 10, 2026
• renovatebot renovate Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance CVE-2026-76226 Fix available 6.8 MediumApril 16, 2026
• mend renovate-ce, renovate-ee-server, renovate-ee-worker +1 more +3 more Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure CVE-2026-76227 Fix available 6.8 MediumFebruary 13, 2026
• renovatebot renovate Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVE-2026-76232 Fix available 8.4 HighJanuary 13, 2026
• renovatebot renovate Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVE-2026-76233 Fix available 8.4 HighJanuary 13, 2026
• renovatebot renovate Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVE-2026-76231 Fix available 8.4 HighJanuary 13, 2026
• renovatebot renovate Renovate 35.63.0 before 40.33.0 Command Injection via npm CVE-2026-76230 Fix available 8.4 HighJanuary 13, 2026
• renovatebot renovate Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize CVE-2026-76229 Fix available 8.4 HighJanuary 13, 2026
• mend renovate-ce, renovatebot renovate, mend renovate-ee-server +1 more +3 more Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVE-2026-76228 Fix available 8.4 HighJanuary 13, 2026
• renovatebot renovate Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 CVE-2024-58376 Fix available 8.4 HighApril 23, 2024
• renovatebot renovate Renovate 19.180.0 before 23.25.1 Token Leakage via Logs CVE-2020-37267 Fix available 8.7 HighSeptember 14, 2020
• renovatebot renovate Renovate before 19.38.7 Credential Exposure via Go Modules CVE-2019-25766 Fix available 8.7 HighOctober 21, 2019