renovatebot vulnerabilities
25 published CVEs name renovatebot among the affected products.
- 25Published CVEs25 of them scored
- 25Last 12 monthspublished in the last year
- 5Critical16 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
renovatebot · renovate
High8.4 - CVE-2026-110867
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
renovatebot · renovate
Critical9.0 - CVE-2026-110866
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
renovatebot · renovate
Medium5.3 - CVE-2026-110865
Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
renovatebot · renovate
High7.1 - CVE-2026-88889
Renovate before 44.14.7 Command Injection via distributionType
renovatebot · renovate
High8.5 - CVE-2026-88888
Renovate before 44.14.7 Command Injection via Mix organization
renovatebot · renovate
High7.3 - CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
renovatebot · renovate
Critical9.2 - CVE-2026-88886
Renovate before 44.14.7 Command Injection via gradle-wrapper
renovatebot · renovate
High8.5 - CVE-2026-88885
Renovate before 44.14.7 Command Injection via depName
renovatebot · renovate
High7.3 - CVE-2026-88884
Renovate before 44.3.1 Authentication Bypass via Digest Updates
renovatebot · renovate
Medium6.9