Skip to contentRenovatebot Renovate vulnerabilities
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasourcesCVE-2026-1108688.4 High
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.60.1 allowedEnv Allowlist Bypass via Shared PresetCVE-2026-1108679.0 Critical
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase RequestCVE-2026-1108665.3 Medium
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.60.1 HTTP Header Allowlist Bypass via Shared PresetsCVE-2026-1108657.1 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via distributionTypeCVE-2026-888898.5 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via Mix organizationCVE-2026-888887.3 High
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.11.2 Credential Exfiltration via Link HeaderCVE-2026-888879.2 Critical
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.14.7 Command Injection via gradle-wrapperCVE-2026-888868.5 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via depNameCVE-2026-888857.3 High
- mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 moreRenovate before 44.3.1 Authentication Bypass via Digest UpdatesCVE-2026-888846.9 Medium
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.14.4 TLS Private Key Log SanitisationCVE-2026-888838.3 High
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.11.2 Credential Exfiltration via Link HeaderCVE-2026-888829.2 Critical
- mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 moreRenovate before 44.11.3 Credential Exfiltration via Link HeaderCVE-2026-888819.2 Critical
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.11.3 Credential Exfiltration via Link HeaderCVE-2026-888809.2 Critical
- renovatebot renovateRenovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenanceCVE-2026-76226Fix available6.8 Medium
- mend renovate-ce, renovate-ee-server, renovate-ee-worker +1 more +3 moreRenovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable ExposureCVE-2026-76227Fix available6.8 Medium
- renovatebot renovateRenovate 31.51.0 before 40.33.0 Command Injection via helmv3CVE-2026-76232Fix available8.4 High
- renovatebot renovateRenovate 39.53.0 before 40.33.0 Command Injection via gleam managerCVE-2026-76233Fix available8.4 High
- renovatebot renovateRenovate 32.135.0 before 40.33.0 Command Injection via hermitCVE-2026-76231Fix available8.4 High
- renovatebot renovateRenovate 35.63.0 before 40.33.0 Command Injection via npmCVE-2026-76230Fix available8.4 High
- renovatebot renovateRenovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomizeCVE-2026-76229Fix available8.4 High
- mend renovate-ce, renovatebot renovate, mend renovate-ee-server +1 more +3 moreRenovate before 42.68.5 Remote Code Execution via Gradle WrapperCVE-2026-76228Fix available8.4 High
- renovatebot renovateRenovate 37.158.0 before 37.199.0 Command Injection via helmv3CVE-2024-58376Fix available8.4 High
- renovatebot renovateRenovate 19.180.0 before 23.25.1 Token Leakage via LogsCVE-2020-37267Fix available8.7 High
- renovatebot renovateRenovate before 19.38.7 Credential Exposure via Go ModulesCVE-2019-25766Fix available8.7 High