CVE-2026-114093 | Medium | 4.3 | 2026-10-21 | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to t… |
CVE-2026-114092 | Medium | 6.5 | 2026-10-21 | Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam… |
CVE-2026-114091 | Medium | 5.3 | 2026-10-21 | Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environ… |
CVE-2026-114089 | High | 8.8 | 2026-10-21 | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<co… |
CVE-2026-114088 | Medium | 6.5 | 2026-10-21 | Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to con… |
CVE-2026-114087 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because… |
CVE-2026-114086 | Medium | 5.3 | 2026-10-21 | Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject d… |
CVE-2026-114085 | High | 7.9 | 2026-10-21 | Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging… |
CVE-2026-114084 | High | 7.7 | 2026-10-21 | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into… |
CVE-2026-114083 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to e… |
CVE-2026-114082 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 strea… |
CVE-2026-114081 | High | 7.7 | 2026-10-21 | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse… |
CVE-2026-114080 | Medium | 5.0 | 2026-10-21 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests… |
CVE-2026-114079 | Medium | 5.4 | 2026-10-21 | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments'… |
CVE-2026-114078 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticat… |
CVE-2026-114077 | High | 7.1 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId al… |
CVE-2026-114076 | Medium | 5.4 | 2026-10-21 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST reque… |
CVE-2026-114075 | Medium | 5.4 | 2026-10-21 | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channel… |
CVE-2026-114074 | Medium | 5.4 | 2026-10-21 | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by… |
CVE-2026-114073 | Medium | 5.5 | 2026-10-21 | Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by seria… |
CVE-2026-114072 | Medium | 4.3 | 2026-10-21 | The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organizatio… |
CVE-2026-114071 | Low | 3.1 | 2026-10-21 | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT env… |
CVE-2026-114070 | Low | 3.5 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in… |
CVE-2026-114069 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environme… |
CVE-2026-114068 | High | 8.3 | 2026-10-21 | Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs… |
CVE-2026-114067 | Medium | 6.5 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holde… |
CVE-2026-114066 | High | 8.1 | 2026-10-21 | Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own… |
CVE-2026-114065 | Medium | 6.5 | 2026-10-21 | Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder tabl… |
CVE-2026-92773 | High | 7.1 | 2026-09-16 | Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can c… |
CVE-2026-85651 | High | 8.5 | 2026-09-04 | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs in… |
CVE-2026-85650 | Medium | 5.4 | 2026-09-04 | Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSR… |
CVE-2026-73659 | High | 8.1 | 2026-08-13 | Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/ap… |
CVE-2026-73658 | High | 8.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4Fet… |
CVE-2026-73657 | Medium | 4.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` i… |
CVE-2026-73656 | Critical | 9.9 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w… |
CVE-2026-73655 | High | 7.4 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/goo… |
CVE-2026-73654 | High | 8.5 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoi… |