Latest high and critical flaws
- CVE-2026-114092 Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.High 8.3 · Oct 20, 2026
- CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<codHigh 8.7 · Oct 20, 2026
- CVE-2026-114088 Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connHigh 8.3 · Oct 20, 2026
- CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because tCritical 9.2 · Oct 20, 2026
- CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging tHigh 8.8 · Oct 20, 2026
- CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into tHigh 8.3 · Oct 20, 2026
- CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to esHigh 8.6 · Oct 20, 2026
- CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 streamHigh 7.2 · Oct 20, 2026
- CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse High 8.3 · Oct 20, 2026
- CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticateHigh 7.2 · Oct 20, 2026
- CVE-2026-114069 Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environmenHigh 8.6 · Oct 20, 2026
- CVE-2026-114068 Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs bHigh 7.2 · Oct 20, 2026
- CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holderHigh 7.1 · Oct 20, 2026
- CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own bHigh 7.2 · Oct 20, 2026
- CVE-2026-114065 Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder tableHigh 7.1 · Oct 20, 2026
- CVE-2026-92773 Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization.High 7.1 · Sep 16, 2026
- CVE-2026-85651 Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs intHigh 8.4 · Sep 4, 2026
- CVE-2026-73659 Trigger.dev is the open-source platform for building AI workflows in TypeScript.High 8.1 · Aug 13, 2026
- CVE-2026-73658 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.High 8.2 · Aug 13, 2026
- CVE-2026-73656 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.Critical 9.9 · Aug 13, 2026
- CVE-2026-73655 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.High 7.4 · Aug 13, 2026
- CVE-2026-73654 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.High 8.5 · Aug 13, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.