TR
Vendor
triggerdotdev
37
CVEs
0
On KEV
28
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114093 | TR trigger.dev triggerdotdev | 4.3 | Oct 21 | Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint |
| CVE-2026-114092 | TR trigger.dev triggerdotdev | 6.5 | Oct 21 | Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action |
| CVE-2026-114091 | TR trigger.dev triggerdotdev | 5.3 | Oct 21 | Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route |
| CVE-2026-114089 | TR trigger.dev triggerdotdev | 8.8 | Oct 21 | Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover |
| CVE-2026-114088 | TR trigger.dev triggerdotdev | 6.5 | Oct 21 | Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO |
| CVE-2026-114087 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets |
| CVE-2026-114086 | TR trigger.dev triggerdotdev | 5.3 | Oct 21 | Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint |
| CVE-2026-114085 | TR trigger.dev triggerdotdev | 7.9 | Oct 21 | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API |
| CVE-2026-114084 | TR trigger.dev triggerdotdev | 7.7 | Oct 21 | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API |
| CVE-2026-114083 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints |
| CVE-2026-114082 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials |
| CVE-2026-114081 | TR trigger.dev triggerdotdev | 7.7 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name |
| CVE-2026-114080 | TR trigger.dev triggerdotdev | 5.0 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL |
| CVE-2026-114079 | TR trigger.dev triggerdotdev | 5.4 | Oct 21 | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint |
| CVE-2026-114078 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup |
| CVE-2026-114077 | TR trigger.dev triggerdotdev | 7.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 |
| CVE-2026-114076 | TR trigger.dev triggerdotdev | 5.4 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL |
| CVE-2026-114075 | TR trigger.dev triggerdotdev | 5.4 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API |
| CVE-2026-114074 | TR trigger.dev triggerdotdev | 5.4 | Oct 21 | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range |
| CVE-2026-114073 | TR trigger.dev triggerdotdev | 5.5 | Oct 21 | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs |
| CVE-2026-114072 | TR trigger.dev triggerdotdev | 4.3 | Oct 21 | Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State |
| CVE-2026-114071 | TR trigger.dev triggerdotdev | 3.1 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route |
| CVE-2026-114070 | TR trigger.dev triggerdotdev | 3.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records |
| CVE-2026-114069 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint |
| CVE-2026-114068 | TR trigger.dev triggerdotdev | 8.3 | Oct 21 | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint |
| CVE-2026-114067 | TR trigger.dev triggerdotdev | 6.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route |
| CVE-2026-114066 | TR trigger.dev triggerdotdev | 8.1 | Oct 21 | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints |
| CVE-2026-114065 | TR trigger.dev triggerdotdev | 6.5 | Oct 21 | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders |
| CVE-2026-92773 | TR trigger.dev triggerdotdev | 7.1 | Sep 16 | Trigger.dev before 4.6.0 GitHub App Installation Takeover |
| CVE-2026-85651 | TR trigger.dev triggerdotdev | 8.5 | Sep 4 | Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay |
| CVE-2026-85650 | TR trigger.dev triggerdotdev | 5.4 | Sep 4 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel |
| CVE-2026-73659 | TR trigger.dev triggerdotdev | 8.1 | Aug 13 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API |
| CVE-2026-73658 | TR trigger.dev triggerdotdev | 8.2 | Aug 13 | Trigger.dev: Cross-tenant object store read and write via URL path traversal |
| CVE-2026-73657 | TR trigger.dev triggerdotdev | 4.2 | Aug 13 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay |
| CVE-2026-73656 | TR trigger.dev triggerdotdev | 9.9 | Aug 13 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state |
| CVE-2026-73655 | TR trigger.dev triggerdotdev | 7.4 | Aug 13 | Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login |
| CVE-2026-73654 | TR trigger.dev triggerdotdev | 8.5 | Aug 13 | Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS |