Triggerdotdev - vulnerabilities (CVEs)

37 CVEs in 1 products, 28 in the last 30 days, newest from 2026-10-21.

Products

• Trigger.dev - 37 CVEs

Newest CVEs of Triggerdotdev

• CVE-2026-114093 - CVSS 5.3 (medium), 2026-10-21: Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to…
• CVE-2026-114091 - CVSS 6 (medium), 2026-10-21: Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime…
• CVE-2026-114092 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route…
• CVE-2026-114089 - CVSS 8.8 (high), 2026-10-21: Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading…
• CVE-2026-114088 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to…
• CVE-2026-114087 - CVSS 9.2 (critical), 2026-10-21: Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because…
• CVE-2026-114086 - CVSS 6.9 (medium), 2026-10-21: Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject…
• CVE-2026-114085 - CVSS 8.8 (high), 2026-10-21: Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging…
• CVE-2026-114084 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into…
• CVE-2026-114083 - CVSS 8.6 (high), 2026-10-21: Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to…
• CVE-2026-114082 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2…
• CVE-2026-114081 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated…
• CVE-2026-114080 - CVSS 5.3 (medium), 2026-10-21: Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests…
• CVE-2026-114079 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other…
• CVE-2026-114078 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows…
• CVE-2026-114077 - CVSS 7.1 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId…
• CVE-2026-114076 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST…
• CVE-2026-114075 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert…
• CVE-2026-114074 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by…
• CVE-2026-114073 - CVSS 6.8 (medium), 2026-10-21: Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by…
• CVE-2026-114072 - CVSS 5.3 (medium), 2026-10-21: The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the…
• CVE-2026-114071 - CVSS 3.1 (low), 2026-10-21: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT…
• CVE-2026-114070 - CVSS 5.1 (medium), 2026-10-21: Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in…
• CVE-2026-114068 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs…
• CVE-2026-114069 - CVSS 8.6 (high), 2026-10-21: Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the…
• CVE-2026-114067 - CVSS 7.1 (high), 2026-10-21: Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token…
• CVE-2026-114066 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own…
• CVE-2026-114065 - CVSS 7.1 (high), 2026-10-21: Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder…
• CVE-2026-92773 - CVSS 7.1 (high), 2026-09-16: Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can…
• CVE-2026-85651 - CVSS 8.5 (high), 2026-09-04: Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs…