CVE-2026-88886

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions='gradleWrapper', ..., a...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

EUVD-2026-75439

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889

Renovate (dependency update automation tool) versions before 44.14.7 contain a command injection vulnerability in the Maven Wrapper manager . An unescaped distributionType parameter in maven-wrapper.properties allows attackers to inject shell commands, leading to remote code execution when Renova...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88889: Improper Neutralization of Special Elements used in an OS Command

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88886: Improper Neutralization of Special Elements used in an OS Command

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

PT-2026-89400

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

PT-2026-89397

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-17149: Improper Neutralization of Input During Web Page Generation

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

CVE-2026-85485 HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

EUVD-2026-74169

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

CVE-2026-85485 HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

CVE-2026-85485

The HTML::FormHandler Perl module in versions before 0.410002 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain error messages when rendered into HTML. Specifically, the Table form layout and the Bootstrap 2 and 3 wrappers splice error strings ...