CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114097Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filterjelmer dulwich · dulwich
- CVE-2026-114096Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout pathsjelmer dulwich · dulwich
- CVE-2026-114095Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_objectjelmer dulwich · dulwich
- CVE-2026-114094Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter pathsjelmer dulwich · dulwich
- CVE-2026-114093Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpointtriggerdotdev trigger.dev
- CVE-2026-114092Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Actiontriggerdotdev trigger.dev
- CVE-2026-114091Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Routetriggerdotdev trigger.dev
- CVE-2026-114090Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Servertrigger.dev cli-v3
- CVE-2026-114089Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeovertriggerdotdev trigger.dev
- CVE-2026-114088Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114087Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114086Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpointtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114085Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload APItriggerdotdev trigger.dev
- CVE-2026-114084Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs APItriggerdotdev trigger.dev
- CVE-2026-114083Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpointstriggerdotdev trigger.dev
- CVE-2026-114082Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentialstriggerdotdev trigger.dev
- CVE-2026-114081Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Nametriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114080Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URLtriggerdotdev trigger.dev
- CVE-2026-114079Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpointtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114078Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookuptriggerdotdev trigger.dev
- CVE-2026-114077Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4triggerdotdev trigger.dev
- CVE-2026-114076Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URLtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114075Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels APItriggerdotdev trigger.dev
- CVE-2026-114074Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Rangetriggerdotdev trigger.dev
- CVE-2026-114073Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logstriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114072Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback Statetriggerdotdev trigger.dev
- CVE-2026-114071Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Routetriggerdotdev trigger.dev
- CVE-2026-114070Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Recordstriggerdotdev trigger.dev
- CVE-2026-114069Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpointtriggerdotdev trigger.dev
- CVE-2026-114068Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpointtriggerdotdev trigger.dev