{"items":[{"id":"CVE-2026-114093","published":"2026-10-21T00:36:57.681Z","updated":"2026-10-27T21:53:27.407Z","title":"Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-114092","published":"2026-10-21T00:36:56.982Z","updated":"2026-10-22T15:54:22.195Z","title":"Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action","severity":"HIGH","score":8.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2026-114091","published":"2026-10-21T00:36:56.273Z","updated":"2026-10-28T15:05:28.082Z","title":"Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route","severity":"MEDIUM","score":6,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-114089","published":"2026-10-21T00:36:54.860Z","updated":"2026-10-28T15:52:55.169Z","title":"Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover","severity":"HIGH","score":8.7,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-114088","published":"2026-10-21T00:36:54.157Z","updated":"2026-10-27T21:52:33.402Z","title":"Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO","severity":"HIGH","score":8.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-114087","published":"2026-10-21T00:36:53.452Z","updated":"2026-10-22T15:57:06.612Z","title":"Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets","severity":"CRITICAL","score":9.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-114086","published":"2026-10-21T00:36:52.744Z","updated":"2026-10-28T15:22:48.613Z","title":"Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint","severity":"MEDIUM","score":6.9,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-114085","published":"2026-10-21T00:36:52.041Z","updated":"2026-10-21T15:49:59.313Z","title":"Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API","severity":"HIGH","score":8.8,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-114084","published":"2026-10-21T00:36:51.356Z","updated":"2026-10-28T15:36:39.961Z","title":"Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API","severity":"HIGH","score":8.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-114083","published":"2026-10-21T00:36:50.649Z","updated":"2026-10-27T21:51:39.382Z","title":"Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints","severity":"HIGH","score":8.6,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2026-114082","published":"2026-10-21T00:36:49.960Z","updated":"2026-10-22T17:42:10.280Z","title":"Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials","severity":"HIGH","score":7.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-114081","published":"2026-10-21T00:36:49.268Z","updated":"2026-10-28T15:23:47.837Z","title":"Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name","severity":"HIGH","score":8.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-114080","published":"2026-10-21T00:36:48.581Z","updated":"2026-10-21T15:50:10.677Z","title":"Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-114079","published":"2026-10-21T00:36:47.902Z","updated":"2026-10-28T15:31:57.770Z","title":"Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-114078","published":"2026-10-21T00:36:47.218Z","updated":"2026-10-27T21:50:08.509Z","title":"Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup","severity":"HIGH","score":7.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-114077","published":"2026-10-21T00:36:46.529Z","updated":"2026-10-22T17:44:28.419Z","title":"Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4","severity":"MEDIUM","score":6.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-114076","published":"2026-10-21T00:36:45.853Z","updated":"2026-10-28T15:24:51.788Z","title":"Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-114075","published":"2026-10-21T00:36:45.162Z","updated":"2026-10-21T15:50:17.161Z","title":"Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-114074","published":"2026-10-21T00:36:44.452Z","updated":"2026-10-28T15:30:10.464Z","title":"Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-114073","published":"2026-10-21T00:36:43.726Z","updated":"2026-10-27T21:47:06.757Z","title":"Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs","severity":"MEDIUM","score":6.8,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-114072","published":"2026-10-21T00:36:43.024Z","updated":"2026-10-22T17:51:56.685Z","title":"Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-114071","published":"2026-10-21T00:36:42.336Z","updated":"2026-10-28T15:22:08.976Z","title":"Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route","severity":"LOW","score":2.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-114070","published":"2026-10-21T00:36:41.635Z","updated":"2026-10-21T15:50:25.029Z","title":"Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records","severity":"MEDIUM","score":5.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-114069","published":"2026-10-21T00:36:40.958Z","updated":"2026-10-28T15:48:44.313Z","title":"Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint","severity":"HIGH","score":8.6,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-114068","published":"2026-10-21T00:36:40.255Z","updated":"2026-10-27T21:45:14.589Z","title":"Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint","severity":"HIGH","score":7.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-114067","published":"2026-10-21T00:36:39.566Z","updated":"2026-10-22T17:55:46.386Z","title":"Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route","severity":"HIGH","score":7.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-114066","published":"2026-10-21T00:36:38.884Z","updated":"2026-10-28T15:21:20.734Z","title":"Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints","severity":"HIGH","score":7.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-114065","published":"2026-10-21T00:36:38.206Z","updated":"2026-10-21T15:50:31.282Z","title":"Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders","severity":"HIGH","score":7.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-92773","published":"2026-09-16T20:32:34.037Z","updated":"2026-09-17T19:25:13.643Z","title":"Trigger.dev before 4.6.0 GitHub App Installation Takeover","severity":"HIGH","score":7.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-85651","published":"2026-09-04T14:32:17.468Z","updated":"2026-09-10T15:08:30.643Z","title":"Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay","severity":"HIGH","score":8.4,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-85650","published":"2026-09-04T14:32:16.770Z","updated":"2026-09-04T15:33:11.240Z","title":"Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel","severity":"MEDIUM","score":5.3,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-73659","published":"2026-08-13T21:19:48.451Z","updated":"2026-08-14T16:18:51.359Z","title":"Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API","severity":"HIGH","score":8.1,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-73658","published":"2026-08-13T21:16:59.110Z","updated":"2026-08-14T16:30:13.661Z","title":"Trigger.dev: Cross-tenant object store read and write via URL path traversal","severity":"HIGH","score":8.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-73657","published":"2026-08-13T21:15:13.982Z","updated":"2026-08-17T17:18:31.643Z","title":"Trigger.dev: Cross-tenant payload poisoning via packet write + replay","severity":"MEDIUM","score":4.2,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-73656","published":"2026-08-13T19:56:04.286Z","updated":"2026-08-14T18:08:12.877Z","title":"Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state","severity":"CRITICAL","score":9.9,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2026-73655","published":"2026-08-13T19:53:50.490Z","updated":"2026-08-18T01:36:28.213Z","title":"Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login","severity":"HIGH","score":7.4,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2026-73654","published":"2026-08-13T19:29:05.537Z","updated":"2026-08-14T16:34:05.435Z","title":"Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS","severity":"HIGH","score":8.5,"vendor":"triggerdotdev","product":"trigger.dev","kev":false,"epss":0.0062,"kevAdded":null}]}