179106 matches found
CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
EUVD-2026-75437
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
CVE-2026-88887
Renovate (dependency update automation tool) is vulnerable to credential exfiltration when listing tags/digests for container images. The root cause is that Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches registry credentials to the follow-up...
CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header
Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...
EUVD-2026-75432
Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...
CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header
Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...
CVE-2026-88882
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images before 15.4.0, helm chart before 10.4.0), when fetching package versions from a NuGet registry , Renovate follows pagination URLs returned in the HTTP Link header without verifying the targ...
Malicious code in eka-kue26-ruro (npm)
Source: amazon-inspector 090a89baf96170faa339048aed1d26c4273f6b994673293694b32eefa881dcad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kue17-wekto (npm)
Source: amazon-inspector 440d59a3b79d4fd634144954577747aa1102ba9d852467374671122468df9b30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kue10-breki (npm)
Source: amazon-inspector 47a330b3541b1f257622058b7ffaf9e94373c03c4680af91b835588b5837648d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kue27-sluey (npm)
Source: amazon-inspector 0d5be7f19d7af184bede3927f4ae777359075f4da32572ef6f97ecaa007851f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik28-breki (npm)
Source: amazon-inspector b39b34af70eff48cd2e2d6987d78662e37917b24b28acb885abb56087f40fb85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik48-miaww (npm)
Source: amazon-inspector 35ccf41eb727d76b7a298bbfe06dd143b0f21bd7185dea941e1ddcedac2f6438 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik1-sluey (npm)
Source: amazon-inspector 6e6d049c1dfb4f4c61c44c709a8e9f0f1254498a1a1bd216d0224fd9d6982941 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik80-kyuki (npm)
Source: amazon-inspector b29178976c773e72d885808c359b9d3499c400be8145aa8d181fda28a3717e03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kolak97-kyuki (npm)
Source: amazon-inspector 9606b3a6e4c2ae757b07ca43462b3023f04b34f5fa3c5930bb268e38d33831d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik34-breki (npm)
Source: amazon-inspector 93e1dcbdba11cba17bfd818f271794719be0f454d7918c84179cacc20a26ca4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik48-sukiwir (npm)
Source: amazon-inspector df048930a8256442f7caafe1395c1b472c9694eb8eb1700d5f0f86b7dbb1b437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kue1-riris (npm)
Source: amazon-inspector 5b355398a23f3a23f310ba81081bd270bc8da1b729e459aa123a6e9b5c452041 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eka-kripik66-sluey (npm)
Source: amazon-inspector 9a2271fe8877b8a066c391a2679e94f5b3dfd21b5d88d0f4fc43975834d49d19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...