CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88881

Renovate versions before 44.11.3 are vulnerable to credential exfiltration when following pagination links in the HTTP Link header. The root cause is that the pagination URL returned by a GitHub server is not validated against the originally contacted host, allowing a malicious or compromised ser...

@cenk1cenk2/renovate-config (>=1.0.9, <=2.3.148), @jamietanna/patch-testing (>=0.1.0, <=0.2.28) +11 more potentially affected by CVE-2026-88881 via renovate (>=21.33.15, <=43.288.0)

renovate NPM version =21.33.15, =1.0.9, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.2.0, =1.0.0, =1.0.1, =0.0.1, =0.11.0, =1.4.3 Source cves: CVE-2026-88881 Source advisory: MEND:CVE-2026-88881...

2pg-oauth (>=1.0.0, <=1.0.1), 3dshex (>=0.1.0, <=0.5.3) +14699 more potentially affected by CVE-2026-88038 via cookies (>=0.1.2, <=0.9.1)

cookies NPM version =0.1.2, =1.0.0, =0.1.0, =0.2.0, =4.11.0, =0.1.4, =1.0.4, =1.0.3, =1.0.0, =1.0.2, =1.0.3, =1.0.3, =1.0.0, =1.0.2, =1.0.5 and more Source cves: CVE-2026-88038 Source advisory: MEND:CVE-2026-88038...

@rustybrooks/eslint-config-prettier (>=1.0.0, <=1.0.18) potentially affected by unknown CVE via eslint-plugin-airbnb-base (0.0.1-security)

eslint-plugin-airbnb-base NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on eslint-plugin-airbnb-base and may be impacted: - @rustybrooks/eslint-config-prettier =1.0.0, =1.0.18 Source cves: unknown CVE Source advisory:...

mpi-cbs-mediforms (0.1.0a2) potentially affected by CVE-2026-55073 via weasyprint (58.0.0)

weasyprint PYPI version 58.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mpi-cbs-mediforms 0.1.0a2 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

asrbench (0.1.0), asrbench-cli (0.1.0) +22 more potentially affected by CVE-2026-55073 via weasyprint (62.3.0)

weasyprint PYPI version 62.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - asrbench 0.1.0 - asrbench-cli 0.1.0 - billingyard 1.1.0 - cardtale =0.1.0, =10.0.0, =0.3.4, =0.1.0, =0.10.0, =0.2.2, =0.1.27, =0.1.0, =0.1....

no-cloud (0.0.8) potentially affected by CVE-2026-55073 via weasyprint (0.34.0)

weasyprint PYPI version 0.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - no-cloud 0.0.8 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88001 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88001 Source advisory: OSV:PYSEC-2026-3878...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88000 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88000 Source advisory: OSV:PYSEC-2026-3877...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-78679 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-78679 Source advisory:...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-84311 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-3911...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-84310 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-84310 Source advisory: OSV:PYSEC-2026-3910...

django-omnibus (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-82397 via tornado (3.1.1)

tornado PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - django-omnibus =0.1.0, =0.2.0 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-82398 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-82398 Source advisory: OSV:PYSEC-2026-3912...

label-sorter (>=0.2.0, <=0.3.0), sereto (0.3.5) potentially affected by CVE-2026-84311 via pypdf (5.8.0)

pypdf PYPI version 5.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - label-sorter =0.2.0, =0.3.0 - sereto 0.3.5 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-3911...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-82398 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-82398 Source advisory: OSV:PYSEC-2026-3912...

pspdfutils (>=3.0.5, <=3.0.7) potentially affected by CVE-2026-84309 via pypdf (3.10.0)

pypdf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pspdfutils =3.0.5, =3.0.7 Source cves: CVE-2026-84309 Source advisory: OSV:PYSEC-2026-3913...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-84311 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-3911...

pretix (>=4.17.0, <=4.17.1), providentia (2.4.0) potentially affected by CVE-2026-84311 via pypdf (3.4.1)

pypdf PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pretix =4.17.0, =4.17.1 - providentia 2.4.0 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-3911...