ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
CVE-2026-110936
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited
2026-10-21 归档
今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the pub...
CVE-2026-114088
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGI...
CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run strea...
CVE-2026-114086
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allow
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deploymen...
CVE-2026-114085
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL sh...
CVE-2026-114084
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates t
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object...
CVE-2026-114083
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via ...
CVE-2026-114082
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write acc
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allow...
CVE-2026-114081
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-f
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalid...
CVE-2026-114080
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments becau...
CVE-2026-114079
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete...
CVE-2026-114078
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTask
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without envir...
CVE-2026-114077
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resol
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal ho...
CVE-2026-114076
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the leg...
CVE-2026-114075
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted us
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-...
CVE-2026-114074
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted ...
CVE-2026-114073
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret v
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth ...
CVE-2026-114072
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint...
CVE-2026-114071
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to co
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key ...
CVE-2026-114069
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvar