triggerdotdev trigger.dev

• CVE-2026-114093 Medium 4.3 Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint 0.2%
• CVE-2026-114092 Medium 6.5 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action 0.6%
• CVE-2026-114091 Medium 5.3 Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route 0.3%
• CVE-2026-114089 High 8.8 Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover 0.2%
• CVE-2026-114088 Medium 6.5 Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO 0.4%
• CVE-2026-114087 High 8.1 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets 0.5%
• CVE-2026-114086 Medium 5.3 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint 0.4%
• CVE-2026-114085 High 7.9 Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API 0.2%
• CVE-2026-114084 High 7.7 Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API 0.4%
• CVE-2026-114083 High 8.1 Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints 0.5%
• CVE-2026-114082 High 8.1 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials 0.3%
• CVE-2026-114081 High 7.7 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name 0.4%
• CVE-2026-114080 Medium 5.0 Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL 0.3%
• CVE-2026-114079 Medium 5.4 Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint 0.3%
• CVE-2026-114078 High 8.1 Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup 0.4%
• CVE-2026-114077 High 7.1 Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 0.3%
• CVE-2026-114076 Medium 5.4 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL 0.3%
• CVE-2026-114075 Medium 5.4 Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API 0.3%
• CVE-2026-114074 Medium 5.4 Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range 0.4%
• CVE-2026-114073 Medium 5.5 Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs 0.2%
• CVE-2026-114072 Medium 4.3 Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State 0.1%
• CVE-2026-114071 Low 3.1 Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route 0.3%
• CVE-2026-114070 Low 3.5 Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records 0.3%
• CVE-2026-114069 High 8.1 Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint 0.4%
• CVE-2026-114068 High 8.3 Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint 0.4%
• CVE-2026-114067 Medium 6.5 Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route 0.3%
• CVE-2026-114066 High 8.1 Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints 0.3%
• CVE-2026-114065 Medium 6.5 Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders 0.4%
• CVE-2026-92773 High 7.1 Trigger.dev before 4.6.0 GitHub App Installation Takeover 0.3%
• CVE-2026-85651 High 8.5 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay 0.5%
• CVE-2026-85650 Medium 5.4 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel 0.3%
• CVE-2026-73659 High 8.1 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API 0.5%
• CVE-2026-73658 High 8.2 Trigger.dev: Cross-tenant object store read and write via URL path traversal 0.4%
• CVE-2026-73657 Medium 4.2 Trigger.dev: Cross-tenant payload poisoning via packet write + replay 0.2%
• CVE-2026-73656 Critical 9.9 Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state 0.5%
• CVE-2026-73655 High 7.4 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login 0.5%
• CVE-2026-73654 High 8.5 Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS 0.6%