TR
Product
trigger.dev
37
CVEs
0
On KEV
9.9
Max CVSS
28
New 30D
Severity mix
Critical 1High 18Medium 16Low 2
Watch
Add trigger.dev to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114092 | 6.5 | Oct 21 | Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action Affected: before 4.5.0 |
| CVE-2026-114088 | 6.5 | Oct 21 | Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO Affected: before 4.5.4 |
| CVE-2026-114067 | 6.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route Affected: 4.5.0 before 4.6.2 |
| CVE-2026-114065 | 6.5 | Oct 21 | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders Affected: before 4.7.3 |
| CVE-2026-114073 | 5.5 | Oct 21 | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs Affected: before 4.5.9 |
| CVE-2026-114079 | 5.4 | Oct 21 | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint Affected: before 4.5.6 |
| CVE-2026-114076 | 5.4 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL Affected: before 4.5.2 |
| CVE-2026-114075 | 5.4 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API Affected: before 4.5.12 |
| CVE-2026-114074 | 5.4 | Oct 21 | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range Affected: before 4.5.10 |
| CVE-2026-85650 | 5.4 | Sep 4 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel Affected: before 4.5.2 |
| CVE-2026-114091 | 5.3 | Oct 21 | Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route Affected: before 4.5.0 |
| CVE-2026-114086 | 5.3 | Oct 21 | Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint Affected: before 4.5.5 |
| CVE-2026-114080 | 5.0 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL Affected: before 4.5.2 |
| CVE-2026-114093 | 4.3 | Oct 21 | Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint Affected: before 4.5.6 |
| CVE-2026-114072 | 4.3 | Oct 21 | Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State Affected: before 4.5.12 |
| CVE-2026-73657 | 4.2 | Aug 13 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay Affected: >= 4.4.2, < 4.5.0-rc.4 |
Showing 16