Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

17 records

Vendor: mend Clear all filters
TI-2026-74558 CVE-2026-110868

Server-side request forgery in Renovate HTTP presets

Priority LOW 36

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00178 Published 2026-10-14 Fixed in 44.79.0, 15.6.0 +1 CWE-918
TI-2026-74557 CVE-2026-110867 · GHSA-6mj2-rf27-53xc

Renovate allowlist bypass: presets override restricted env vars

Priority MEDIUM 41

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-863
TI-2026-74556 CVE-2026-110866

Renovate bypasses minimumReleaseAge checks through PR rebase requests

Priority LOW 23

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00209 Published 2026-10-14 Fixed in 44.61.3, 15.5.0 +1 CWE-693
TI-2026-74555 CVE-2026-110865

Renovate allowlist bypass lets repository users inject HTTP headers

Priority LOW 30

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00185 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-424
TI-2026-60273 CVE-2026-88889 · GHSA-q946-5qg8-8wmj

Renovate before 44.14.7 Command Injection via distributionType

Priority MEDIUM 41

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.pr…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.01049 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78
TI-2026-60272 CVE-2026-88888 · GHSA-x7x2-5fmx-8wj5

Renovate before 44.14.7 Command Injection via Mix organization

Priority LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78
TI-2026-60269 CVE-2026-88885 · GHSA-74v7-vgrr-xqjq

Renovate before 44.14.7 Command Injection via depName

Priority LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78
TI-2026-60265 CVE-2026-88881 · GHSA-gwwm-f4gw-c69f

Renovate before 44.11.3 Credential Exfiltration via Link Header

Priority MEDIUM 46

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the c…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00409 Published 2026-09-10 Fixed in 44.11.3, 15.4.0 +1 CWE-601
TI-2026-60264 CVE-2026-88880 · GHSA-wqcg-39wp-gpqc

Renovate before 44.11.3 Credential Exfiltration via Link Header

Priority MEDIUM 46

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00504 Published 2026-09-10 Fixed in 44.11.3, 15.4.0 +1 CWE-601
TI-2026-53333 CVE-2026-76228 · GHSA-mqp7-cg7m-4hhq

Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Priority HIGH 72

Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.00959 Published 2026-08-19 Fixed in 42.68.5, 13.3.0 CWE-78
TI-2026-53332 CVE-2026-76227 · GHSA-p44v-39mg-jgrj

Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

Priority LOW 29

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0…

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00154 Published 2026-08-19 Fixed in 42.96.3, 43.4.4 +1 CWE-526
TI-2022-07251 CVE-2022-23082 · GHSA-m9vj-44f3-78xw

CureKit - Path Traversal in isFileOutsideDir

Priority LOW 36

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01329 Published 2022-05-31 Fixed in 1.1.4 CWE-22