CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:23 UTC)

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,468; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product renovatebot:renovate. Show all products

25 CVEs, showing 1 to 25

CVE	Severity	Title	Published
CVE-2019-25766	High 7.5	Renovate before 19.38.7 Credential Exposure via Go Modules Assigned by VulnCheck	Aug 19, 2026
CVE-2020-37267	High 7.5	Renovate 19.180.0 before 23.25.1 Token Leakage via Logs Assigned by VulnCheck	Aug 19, 2026
CVE-2024-58376	Medium 6.7	Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76226	Medium 6.3	Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76227	Medium 5.5	Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76228	Medium 6.7	Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76229	Medium 6.7	Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76230	Medium 6.7	Renovate 35.63.0 before 40.33.0 Command Injection via npm Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76231	Medium 6.7	Renovate 32.135.0 before 40.33.0 Command Injection via hermit Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76232	Medium 6.7	Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76233	Medium 6.7	Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager Assigned by VulnCheck	Aug 19, 2026
CVE-2026-88880	High 8.6	Renovate before 44.11.3 Credential Exfiltration via Link Header Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88881	High 8.6	Renovate before 44.11.3 Credential Exfiltration via Link Header Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88882	High 8.6	Renovate before 44.11.2 Credential Exfiltration via Link Header Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88883	High 7.7	Renovate before 44.14.4 TLS Private Key Log Sanitisation Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88884	Medium 5.8	Renovate before 44.3.1 Authentication Bypass via Digest Updates Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88885	High 7.0	Renovate before 44.14.7 Command Injection via depName Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88886	High 7.8	Renovate before 44.14.7 Command Injection via gradle-wrapper Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88887	High 8.6	Renovate before 44.11.2 Credential Exfiltration via Link Header Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88888	High 7.0	Renovate before 44.14.7 Command Injection via Mix organization Assigned by VulnCheck	Sep 10, 2026
CVE-2026-88889	High 7.8	Renovate before 44.14.7 Command Injection via distributionType Assigned by VulnCheck	Sep 10, 2026
CVE-2026-110865	High 7.1	Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets Assigned by VulnCheck	Oct 14, 2026
CVE-2026-110866	Medium 4.7	Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request Assigned by VulnCheck	Oct 14, 2026
CVE-2026-110867	High 8.5	Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset Assigned by VulnCheck	Oct 14, 2026
CVE-2026-110868	High 8.5	Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources Assigned by VulnCheck	Oct 14, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.