Triggerdotdev vulnerabilities
37 CVEs and advisories name Triggerdotdev as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-85650Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
- CVE-2026-73659Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API
- CVE-2026-73658Trigger.dev: Cross-tenant object store read and write via URL path traversal
- CVE-2026-73657Trigger.dev: Cross-tenant payload poisoning via packet write + replay
- CVE-2026-73656Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
- CVE-2026-73655Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login
- CVE-2026-73654Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS