# cve.now: Renovatebot

The newest entries naming Renovatebot as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110868](https://cve.now/CVE-2026-110868.md): Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources (CVSS 8.4)
- [CVE-2026-110867](https://cve.now/CVE-2026-110867.md): Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset (CVSS 9.0)
- [CVE-2026-110866](https://cve.now/CVE-2026-110866.md): Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request (CVSS 5.3)
- [CVE-2026-110865](https://cve.now/CVE-2026-110865.md): Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets (CVSS 7.1)
- [CVE-2026-88889](https://cve.now/CVE-2026-88889.md): Renovate before 44.14.7 Command Injection via distributionType (CVSS 8.5)
- [CVE-2026-88888](https://cve.now/CVE-2026-88888.md): Renovate before 44.14.7 Command Injection via Mix organization (CVSS 7.3)
- [CVE-2026-88887](https://cve.now/CVE-2026-88887.md): Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 9.2)
- [CVE-2026-88886](https://cve.now/CVE-2026-88886.md): Renovate before 44.14.7 Command Injection via gradle-wrapper (CVSS 8.5)
- [CVE-2026-88885](https://cve.now/CVE-2026-88885.md): Renovate before 44.14.7 Command Injection via depName (CVSS 7.3)
- [CVE-2026-88884](https://cve.now/CVE-2026-88884.md): Renovate before 44.3.1 Authentication Bypass via Digest Updates (CVSS 6.9)
- [CVE-2026-88883](https://cve.now/CVE-2026-88883.md): Renovate before 44.14.4 TLS Private Key Log Sanitisation (CVSS 8.3)
- [CVE-2026-88882](https://cve.now/CVE-2026-88882.md): Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 9.2)
- [CVE-2026-88881](https://cve.now/CVE-2026-88881.md): Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 9.2)
- [CVE-2026-88880](https://cve.now/CVE-2026-88880.md): Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 9.2)
- [CVE-2026-76233](https://cve.now/CVE-2026-76233.md): Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager (CVSS 8.4)
- [CVE-2026-76232](https://cve.now/CVE-2026-76232.md): Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 (CVSS 8.4)
- [CVE-2026-76231](https://cve.now/CVE-2026-76231.md): Renovate 32.135.0 before 40.33.0 Command Injection via hermit (CVSS 8.4)
- [CVE-2026-76230](https://cve.now/CVE-2026-76230.md): Renovate 35.63.0 before 40.33.0 Command Injection via npm (CVSS 8.4)
- [CVE-2026-76229](https://cve.now/CVE-2026-76229.md): Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize (CVSS 8.4)
- [CVE-2026-76228](https://cve.now/CVE-2026-76228.md): Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper (CVSS 8.4)
- [CVE-2026-76227](https://cve.now/CVE-2026-76227.md): Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure (CVSS 6.8)
- [CVE-2026-76226](https://cve.now/CVE-2026-76226.md): Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance (CVSS 6.8)
- [CVE-2024-58376](https://cve.now/CVE-2024-58376.md): Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 (CVSS 8.4)
- [CVE-2020-37267](https://cve.now/CVE-2020-37267.md): Renovate 19.180.0 before 23.25.1 Token Leakage via Logs (CVSS 8.7)
- [CVE-2019-25766](https://cve.now/CVE-2019-25766.md): Renovate before 19.38.7 Credential Exposure via Go Modules (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/renovatebot
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.