[ Vendor · 28 CVEs ]
triggerdotdev
CVEs affecting triggerdotdev published in the last 30 days, plus any triggerdotdev CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114091 | 21 Oct 2026 | CVSS 5.3 | triggerdotdev trigger.devTrigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's… | |
| CVE-2026-114092 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route… | |
| CVE-2026-114093 | 21 Oct 2026 | CVSS 4.3 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a… | |
| CVE-2026-114085 | 21 Oct 2026 | CVSS 7.9 | triggerdotdev trigger.devTrigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs… | |
| CVE-2026-114086 | 21 Oct 2026 | CVSS 5.3 | triggerdotdev trigger.devTrigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers… | |
| CVE-2026-114087 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication… | |
| CVE-2026-114088 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated… | |
| CVE-2026-114089 | 21 Oct 2026 | CVSS 8.8 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading… | |
| CVE-2026-114078 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows… | |
| CVE-2026-114079 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other… | |
| CVE-2026-114080 | 21 Oct 2026 | CVSS 5.0 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send… | |
| CVE-2026-114081 | 21 Oct 2026 | CVSS 7.7 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated… | |
| CVE-2026-114082 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain… | |
| CVE-2026-114083 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated… | |
| CVE-2026-114084 | 21 Oct 2026 | CVSS 7.7 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query… | |
| CVE-2026-114072 | 21 Oct 2026 | CVSS 4.3 | triggerdotdev trigger.devThe Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the… | |
| CVE-2026-114073 | 21 Oct 2026 | CVSS 5.5 | triggerdotdev trigger.devTrigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment… | |
| CVE-2026-114074 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF… | |
| CVE-2026-114075 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create… | |
| CVE-2026-114076 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send… | |
| CVE-2026-114077 | 21 Oct 2026 | CVSS 7.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by… | |
| CVE-2026-114066 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they… | |
| CVE-2026-114067 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session… | |
| CVE-2026-114068 | 21 Oct 2026 | CVSS 8.3 | triggerdotdev trigger.devTrigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to… | |
| CVE-2026-114069 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the… | |
| CVE-2026-114070 | 21 Oct 2026 | CVSS 3.5 | triggerdotdev trigger.devTrigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor… | |
| CVE-2026-114071 | 21 Oct 2026 | CVSS 3.1 | triggerdotdev trigger.devTrigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's… | |
| CVE-2026-114065 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using… |