CVE-2026-64837

ICEcoder through 8.1 is vulnerable to OS command injection in lib/properties.php . The root cause is an unescaped filesystem path passed to a shell command via popen() . An authenticated attacker can create directories containing shell metacharacters in their names and then invoke the Properties ...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

EUVD-2026-75454

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-88889

A flaw was found in Renovate. This command injection vulnerability exists in the Maven Wrapper manager, allowing a remote attacker to execute arbitrary commands. By specifying a malicious distributionType parameter in maven-wrapper.properties, an attacker can inject shell commands. This leads to...

CVE-2026-88888

A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...

CVE-2026-88889

Renovate (dependency update automation tool) versions before 44.14.7 contain a command injection vulnerability in the Maven Wrapper manager . An unescaped distributionType parameter in maven-wrapper.properties allows attackers to inject shell commands, leading to remote code execution when Renova...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

EUVD-2026-75439

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

EUVD-2026-75438

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888

Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...