R
Vendor security profile
renovate
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs25
Critical0
CISA KEV0
Public exploit0
Patch rate—
Avg. CVSS—
12-month vulnerability rate
CVE KEV
CVE severity distribution
25toplam CVE
Uncertain25 (100%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
25Unknown
Latest vulnerabilities
8.4
CVE-2026-110868Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
Patch status unknownEPSS %0
9.0
CVE-2026-110867Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Patch status unknownEPSS %0
5.3
CVE-2026-110866Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Patch status unknownEPSS %0
7.1
CVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
Patch status unknownEPSS %0
8.5
CVE-2026-88889Renovate before 44.14.7 Command Injection via distributionType
Patch status unknownEPSS %1
7.3
CVE-2026-88888Renovate before 44.14.7 Command Injection via Mix organization
Patch status unknownEPSS %1
9.2
CVE-2026-88887Renovate before 44.11.2 Credential Exfiltration via Link Header
Patch status unknownEPSS %0
8.5
CVE-2026-88886Renovate before 44.14.7 Command Injection via gradle-wrapper
Patch status unknownEPSS %0
7.3
CVE-2026-88885Renovate before 44.14.7 Command Injection via depName
Patch status unknownEPSS %1
6.9
CVE-2026-88884Renovate before 44.3.1 Authentication Bypass via Digest Updates
Patch status unknownEPSS %0