Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| trigger.dev | CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the… |
8,8 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114086 Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject… |
6,9 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then… |
9,2 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114088 Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables… |
8,3 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then… |
8,7 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| cli-v3 | CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task,… |
7,6 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's… |
7,2 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114079 Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can… |
5,3 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114080 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata… |
5,3 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a… |
8,3 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or… |
7,2 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences… |
8,6 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key… |
8,3 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114072 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an… |
5,3 | 0,12 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114073 Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting… |
6,8 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114074 Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed… |
5,3 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114075 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create… |
5,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114076 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud… |
5,3 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment… |
6,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST… |
7,2 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation… |
7,1 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114068 Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that… |
7,2 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114069 Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key… |
8,6 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114070 Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the… |
5,1 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-114071 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit… |
2,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 11:02 UTC – 15.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.