PT-2026-78410

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-76228: Improper Neutralization of Special Elements used in an OS Command

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by CVE-2026-73413 via shescape (>=2.1.11, <=2.1.12)

shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: CVE-2026-73413 Source advisory: SNYK:JS-SHESCAPE-18752068...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, apache-tika, conductor-fips, conductor, scala, gradle, metabase, copybara-fips, opensearch-fips, copybara, apache-hop, apache-hop-fips, elasticsearch-fips, jbang, wazuh-indexer, elasticsearch, opensearch, nextflow, apache-tika-fips...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, apache-tika, conductor-fips, conductor, scala, gradle, metabase, copybara-fips, opensearch-fips, copybara, apache-hop, apache-hop-fips, elasticsearch-fips, jbang, wazuh-indexer, elasticsearch, opensearch, nextflow, apache-tika-fips...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: opensearch, spdx-tools-java, gradle, nextflow, apache-tika...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: opensearch, spdx-tools-java, gradle, nextflow, apache-tika...

@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by unknown CVE via shescape (>=2.1.11, <=2.1.12)

shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: unknown CVE Source advisory: SNYK:JS-SHESCAPE-18319522...

@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by CVE-2026-73413 via shescape (>=2.1.11, <=2.1.12)

shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: CVE-2026-73413 Source advisory: OSV:GHSA-GM3R-Q2WP-HW87...

GHSA-R7WM-3CXJ-WFF9 vulnerabilities

Vulnerabilities for packages: trino, strimzi-kafka-operator, akhq, logstash, spark, gradle, apache-nifi-registry, apache-tika, dependency-track, keycloak, apache-nifi, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry, flyway, tez, opensearch, spdx-tools-java, scala,...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: flyway-fips, ruby3.2-jrjackson, geoserver, spark-fips, apache-tika, confluent-kafka, keycloak, wavefront-proxy, strimzi-kafka-operator-fips, infinispan, wso2is, s3proxy, flyway, keycloak-fips, scala, camunda-zeebe, keycloak-config-cli, s3proxy-fips, kafbat-ui-fips,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: flyway-fips, ruby3.2-jrjackson, geoserver, spark-fips, apache-tika, confluent-kafka, keycloak, wavefront-proxy, infinispan, wso2is, flyway, keycloak-fips, camunda-zeebe, keycloak-config-cli, kafbat-ui-fips, akhq, nacos-docker, gradle, jenkins, zookeeper,...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: flyway-fips, ruby3.2-jrjackson, geoserver, spark-fips, apache-tika, confluent-kafka, keycloak, wavefront-proxy, strimzi-kafka-operator-fips, infinispan, wso2is, s3proxy, flyway, keycloak-fips, scala, camunda-zeebe, keycloak-config-cli, s3proxy-fips, kafbat-ui-fips,...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, spark, gradle, apache-nifi-registry, apache-tika, ruby3.2-jrjackson, thingsboard, confluent-kafka, keycloak, apache-nifi, infinispan, druid, keycloak-config-cli, apicurio-registry, flyway,...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, spark, gradle, apache-nifi-registry, apache-tika, ruby3.2-jrjackson, thingsboard, confluent-kafka, keycloak, apache-nifi, infinispan, druid, keycloak-config-cli, apicurio-registry, flyway,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: jenkins-plugin-manager, trino, akhq, logstash, spark, gradle, apache-tika, ruby3.2-jrjackson, thingsboard, confluent-kafka, keycloak, infinispan, druid, keycloak-config-cli, flyway, zookeeper, tez, opensearch, ruby3.3-jrjackson, wavefront-proxy, sonarqube, cassandra...

Code Injection

Nuclio is vulnerable to Code Injection. The vulnerability is due to unsanitized runtimeAttributes.repositories values being injected into the generated build.gradle file, which allows an attacker to inject and execute arbitrary Groovy code during the Gradle build process, resulting in remote code...

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories blo...

PT-2026-60684

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...