Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-fj2x-mqqp-3v2w
  • npm/trigger.dev
 Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values 20 hours ago
  • Fix available
  • Severity - 5.5 (Medium)
GHSA-4672-hwv6-gq62
  • npm/trigger.dev
 Trigger.dev: Cross-environment deployment cancel 20 hours ago
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-9q4r-4842-93vw
  • npm/trigger.dev
 Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name 20 hours ago
  • Fix available
  • Severity - 7.7 (High)
GHSA-59h8-w5q6-mfmp
  • npm/trigger.dev
 Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId 20 hours ago
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-pqxw-g93w-hj9x
  • npm/trigger.dev
 Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise 20 hours ago
  • Fix available
  • Severity - 8.1 (High)
GHSA-gg6r-gp4c-89hp
  • npm/trigger.dev
 Trigger.dev: V1 coordinator default-secret unauth Socket.IO 20 hours ago
  • Fix available
  • Severity - 9.2 (Critical)
GHSA-q567-cr4x-96w4
  • npm/trigger.dev
 Trigger.dev: Blind SSRF via alert-channel webhook 20 hours ago
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-pp95-gc86-jq6q
  • npm/trigger.dev
 Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) 20 hours ago
  • Fix available
  • Severity - 7.1 (High)
GHSA-xxv7-2vv3-h682
  • npm/trigger.dev
 Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL 23 hours ago
  • Fix available
  • Severity - 7.7 (High)
GHSA-qxpp-qjg8-x4jv
  • npm/trigger.dev
 Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) 23 hours ago
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-92773
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev before 4.6.0 GitHub App Installation Takeover 16 Sep
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-85651
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay 04 Sep
  • Fix available
  • Severity - 8.4 (High)
CVE-2026-85650
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel 04 Sep
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-73659
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API 13 Aug
  • Fix available
  • Severity - 8.1 (High)
CVE-2026-73658
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev: Cross-tenant object store read and write via URL path traversal 13 Aug
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-73657
  • github.com/triggerdotdev/trigger.dev
 Trigger.dev: Cross-tenant payload poisoning via packet write + replay 13 Aug
  • Fix available
  • Severity - 4.2 (Medium)
Load more...