CVE-2026-54794

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-76243 stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments...

CVE-2026-76243

stigmem (stigmem-node) versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with an anonymous identity when nodes are exposed outside local development environments. The CVSS ...

EUVD-2026-62407

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76238

stigmem before 0.9.0a12 has a BOLA flaw in the decay sweep endpoint. Authenticated attackers with write access to one tenant can POST with ttl_seconds=0 to expire facts across all tenants, or use dry_run to retrieve cross-tenant fact counts and existence data. CVSS 4.0 scores 7.2 HIGH (integrity ...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76233

Renovate versions 39.53.0 through before 40.33.0 are affected by a command injection vulnerability in the gleam manager . The depName parameter from gleam.toml is appended to gleam deps update shell commands without proper sanitization (missing quote from the shlex package in lib/modules/manager/...

EUVD-2026-62472

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76231

Affected: Renovate bot versions 32.135.0 to before 40.33.0. Root cause: The hermit manager appends user-supplied dependency names to shell install/uninstall commands without sanitization. Impact: Attackers with repository write access can inject malicious dependency names to execute arbitrary com...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76216

Vikunja through 2.4.0 is affected by a principal-type confusion vulnerability. Three permission checks lack type guards, causing LinkSharing principals with id N to be incorrectly treated as user principals where users.id == N. An attacker holding a valid link-share JWT can exploit id collisions ...