triggerdotdev trigger.dev
37 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114093 | < 4.5.6 | Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-114092 | < 4.5.0 | Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action | HIGH 8.3 | 0.6 % | ||
| CVE-2026-114091 | < 4.5.0 | Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-114089 | < 4.5.2 | Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover | HIGH 8.7 | 0.1 % | ||
| CVE-2026-114088 | < 4.5.4 | Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO | HIGH 8.3 | 0.4 % | ||
| CVE-2026-114087 | < 4.5.6 | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-114086 | < 4.5.5 | Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-114085 | ≤ 4.7.6 | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API | HIGH 8.8 | 0.2 % | ||
| CVE-2026-114084 | < 4.5.6 | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API | HIGH 8.3 | 0.3 % | ||
| CVE-2026-114083 | < 4.5.0-rc.3 | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints | HIGH 8.6 | 0.5 % | ||
| CVE-2026-114082 | < 4.6.2 | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials | HIGH 7.2 | 0.3 % | ||
| CVE-2026-114081 | < 4.5.6 | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name | HIGH 8.3 | 0.3 % | ||
| CVE-2026-114080 | < 4.5.2 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-114079 | < 4.5.6 | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-114078 | < 4.5.6 | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup | HIGH 7.2 | 0.4 % | ||
| CVE-2026-114077 | < 4.5.6 | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114076 | < 4.5.2 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-114075 | < 4.5.12 | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-114074 | < 4.5.10 | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-114073 | < 4.5.9 | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-114072 | < 4.5.12 | Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-114071 | < 4.5.12 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route | LOW 2.3 | 0.2 % | ||
| CVE-2026-114070 | 4.5.0 – < 4.6.0 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-114069 | < 4.6.0 | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint | HIGH 8.6 | 0.3 % | ||
| CVE-2026-114068 | < 4.6.0 | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint | HIGH 7.2 | 0.4 % | ||
| CVE-2026-114067 | 4.5.0 – < 4.6.2 | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route | HIGH 7.1 | 0.3 % | ||
| CVE-2026-114066 | < 4.7.0 | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints | HIGH 7.2 | 0.3 % | ||
| CVE-2026-114065 | < 4.7.3 | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders | HIGH 7.1 | 0.4 % | ||
| CVE-2026-92773 | < 4.6.0 | Trigger.dev before 4.6.0 GitHub App Installation Takeover | HIGH 7.1 | 0.3 % | ||
| CVE-2026-85651 | < 4.5.2 | Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay | HIGH 8.4 | 0.5 % | ||
| CVE-2026-85650 | < 4.5.2 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-73659 | >= 4.4.2, < 4.5.0 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API | HIGH 8.1 | 0.5 % | ||
| CVE-2026-73658 | >= 4.4.2, < 4.5.0-rc.5 | Trigger.dev: Cross-tenant object store read and write via URL path traversal | HIGH 8.2 | 0.4 % | ||
| CVE-2026-73657 | >= 4.4.2, < 4.5.0-rc.4 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-73656 | < 4.5.2 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-73655 | < 4.5.2 | Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login | HIGH 7.4 | 0.5 % | ||
| CVE-2026-73654 | >= 3.3.8, < 4.5.6 | Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS | HIGH 8.5 | 0.6 % |