News & Sicurezza

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

CVE ID :CVE-2026-73388 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated SQL Injection in Nikstore Core Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73387 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated Local File Inclusion in Resido Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73391 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated SQL Injection in Total Donations Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73390 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated Privilege Escalation in Total Donations Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73394 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated Broken Access Control in Stitch Express Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73389 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated PHP Object Injection in Kalles Addons Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73347 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated Privilege Escalation in TrueBooker Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-73354 Published : Aug. 19, 2026, 1:18 p.m. | 14 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...