renovate
- Software type
- Developer tool
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/31/2026, renovate recorded 25 security vulnerabilities in the last 90 days, of which 21 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of renovate and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110868Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasourcesCVE-2026-110867Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared PresetCVE-2026-110866Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase RequestCVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared PresetsCVE-2026-88889Renovate before 44.14.7 Command Injection via distributionType| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-110868Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-110867Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityCritical |
|---|
CVE-2026-110866Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-88889Renovate before 44.14.7 Command Injection via distributionType | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88888Renovate before 44.14.7 Command Injection via Mix organization | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88887Renovate before 44.11.2 Credential Exfiltration via Link Header | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityCritical |
|---|
CVE-2026-88886Renovate before 44.14.7 Command Injection via gradle-wrapper | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88885Renovate before 44.14.7 Command Injection via depName | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88884Renovate before 44.3.1 Authentication Bypass via Digest Updates | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityMedium |
|---|
25 Results | Page 1 of 3