Triggerdotdev vulnerabilities
37 CVEs and advisories name Triggerdotdev as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114093Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
- CVE-2026-114092Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
- CVE-2026-114091Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
- CVE-2026-114089Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
- CVE-2026-114088Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
- CVE-2026-114087Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
- CVE-2026-114086Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint
- CVE-2026-114085Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
- CVE-2026-114084Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
- CVE-2026-114083Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
- CVE-2026-114082Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
- CVE-2026-114081Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
- CVE-2026-114080Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
- CVE-2026-114079Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
- CVE-2026-114078Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
- CVE-2026-114077Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
- CVE-2026-114076Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
- CVE-2026-114075Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API
- CVE-2026-114074Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range
- CVE-2026-114073Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
- CVE-2026-114072Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
- CVE-2026-114071Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
- CVE-2026-114070Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records
- CVE-2026-114069Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
- CVE-2026-114068Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
- CVE-2026-114067Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
- CVE-2026-114066Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
- CVE-2026-114065Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
- CVE-2026-92773Trigger.dev before 4.6.0 GitHub App Installation Takeover
- CVE-2026-85651Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay