# cve.now: Triggerdotdev

The newest entries naming Triggerdotdev as an affected vendor (up to 200), of 37 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114093](https://cve.now/CVE-2026-114093.md): Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint (CVSS 5.3)
- [CVE-2026-114092](https://cve.now/CVE-2026-114092.md): Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action (CVSS 8.3)
- [CVE-2026-114091](https://cve.now/CVE-2026-114091.md): Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route (CVSS 6.0)
- [CVE-2026-114089](https://cve.now/CVE-2026-114089.md): Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover (CVSS 8.7)
- [CVE-2026-114088](https://cve.now/CVE-2026-114088.md): Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO (CVSS 8.3)
- [CVE-2026-114087](https://cve.now/CVE-2026-114087.md): Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets (CVSS 9.2)
- [CVE-2026-114086](https://cve.now/CVE-2026-114086.md): Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint (CVSS 6.9)
- [CVE-2026-114085](https://cve.now/CVE-2026-114085.md): Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API (CVSS 8.8)
- [CVE-2026-114084](https://cve.now/CVE-2026-114084.md): Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API (CVSS 8.3)
- [CVE-2026-114083](https://cve.now/CVE-2026-114083.md): Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints (CVSS 8.6)
- [CVE-2026-114082](https://cve.now/CVE-2026-114082.md): Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials (CVSS 7.2)
- [CVE-2026-114081](https://cve.now/CVE-2026-114081.md): Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name (CVSS 8.3)
- [CVE-2026-114080](https://cve.now/CVE-2026-114080.md): Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL (CVSS 5.3)
- [CVE-2026-114079](https://cve.now/CVE-2026-114079.md): Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint (CVSS 5.3)
- [CVE-2026-114078](https://cve.now/CVE-2026-114078.md): Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup (CVSS 7.2)
- [CVE-2026-114077](https://cve.now/CVE-2026-114077.md): Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 (CVSS 6.1)
- [CVE-2026-114076](https://cve.now/CVE-2026-114076.md): Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL (CVSS 5.3)
- [CVE-2026-114075](https://cve.now/CVE-2026-114075.md): Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API (CVSS 5.3)
- [CVE-2026-114074](https://cve.now/CVE-2026-114074.md): Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range (CVSS 5.3)
- [CVE-2026-114073](https://cve.now/CVE-2026-114073.md): Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs (CVSS 6.8)
- [CVE-2026-114072](https://cve.now/CVE-2026-114072.md): Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State (CVSS 5.3)
- [CVE-2026-114071](https://cve.now/CVE-2026-114071.md): Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route (CVSS 2.3)
- [CVE-2026-114070](https://cve.now/CVE-2026-114070.md): Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records (CVSS 5.1)
- [CVE-2026-114069](https://cve.now/CVE-2026-114069.md): Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint (CVSS 8.6)
- [CVE-2026-114068](https://cve.now/CVE-2026-114068.md): Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint (CVSS 7.2)
- [CVE-2026-114067](https://cve.now/CVE-2026-114067.md): Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route (CVSS 7.1)
- [CVE-2026-114066](https://cve.now/CVE-2026-114066.md): Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints (CVSS 7.2)
- [CVE-2026-114065](https://cve.now/CVE-2026-114065.md): Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders (CVSS 7.1)
- [CVE-2026-92773](https://cve.now/CVE-2026-92773.md): Trigger.dev before 4.6.0 GitHub App Installation Takeover (CVSS 7.1)
- [CVE-2026-85651](https://cve.now/CVE-2026-85651.md): Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay (CVSS 8.4)
- [CVE-2026-85650](https://cve.now/CVE-2026-85650.md): Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel (CVSS 5.3)
- [CVE-2026-73659](https://cve.now/CVE-2026-73659.md): Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API (CVSS 8.1)
- [CVE-2026-73658](https://cve.now/CVE-2026-73658.md): Trigger.dev: Cross-tenant object store read and write via URL path traversal (CVSS 8.2)
- [CVE-2026-73657](https://cve.now/CVE-2026-73657.md): Trigger.dev: Cross-tenant payload poisoning via packet write + replay (CVSS 4.2)
- [CVE-2026-73656](https://cve.now/CVE-2026-73656.md): Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state (CVSS 9.9)
- [CVE-2026-73655](https://cve.now/CVE-2026-73655.md): Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login (CVSS 7.4)
- [CVE-2026-73654](https://cve.now/CVE-2026-73654.md): Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS (CVSS 8.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/triggerdotdev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.