Vulnerabilities in triggerdotdev
37 resultsCVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.6%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-114083HIGHTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL EndpointsEPSS 0.5%CVE-2026-85651HIGHTrigger.dev before 4.5.2 Unauthorized Environment Access via Run ReplayEPSS 0.5%CVE-2026-73655HIGHTrigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google LoginEPSS 0.5%CVE-2026-114078HIGHTrigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId LookupEPSS 0.4%CVE-2026-73658HIGHTrigger.dev: Cross-tenant object store read and write via URL path traversalEPSS 0.4%CVE-2026-114088HIGHTrigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOEPSS 0.4%CVE-2026-114081HIGHTrigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function NameEPSS 0.4%CVE-2026-114084HIGHTrigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs APIEPSS 0.4%CVE-2026-114086MEDIUMTrigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams EndpointEPSS 0.4%CVE-2026-114069HIGHTrigger.dev before 4.6.0 Root Secret Disclosure via envvars API EndpointEPSS 0.4%CVE-2026-114068HIGHTrigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait EndpointEPSS 0.4%CVE-2026-114065HIGHTrigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table PlaceholdersEPSS 0.4%CVE-2026-114074MEDIUMTrigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 RangeEPSS 0.4%CVE-2026-114077MEDIUMTrigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4EPSS 0.3%CVE-2026-85650MEDIUMTrigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channelEPSS 0.3%