Renovate Ee Worker
Approved changes feed: RSS · Atom
cpe:2.3:a:mend:renovate-ee-worker:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mend (d0ffe587-5719-533b-addb-869daff3a35f) |
|---|---|
| Product | Renovate Ee Worker (9640c335-0a3b-5e0c-8b0e-93371a77b8ab) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110865 |
vulnerable | 2026-11-03 10:16:01.276233 |
Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
HIGH (7.1)
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Published: 2026-10-14T22:52:52.525Z
Updated: 2026-10-26T15:22:16.486Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110866 |
vulnerable | 2026-11-03 10:16:00.930984 |
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
MEDIUM (4.7)
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
Published: 2026-10-14T22:52:53.970Z
Updated: 2026-10-20T02:27:10.660Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110867 |
vulnerable | 2026-11-03 10:16:00.415483 |
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
HIGH (8.5)
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
Published: 2026-10-14T22:52:55.043Z
Updated: 2026-10-15T13:31:59.164Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.