Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
### Summary A cross-tenant SQL injection in the TSQL query compiler lets **any authenticated trigger.dev customer read
#advisory
共收录 23210 条相关情报。
← 返回所有主题Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
## Summary The POST handler for `/realtime/v1/streams/:runId/:streamId` has no authentication. Any entity that knows or
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
## Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default s
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
CVE-2026-96780
### Impact A denial-of-service (infinite loop) can occur in `text()` / `textSync()` when **both**: - `whitespaceBreak: t
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
## TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coo
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
CVE-2026-77387
### Impact `geopy.Point` and `Point.from_string()` may take excessive CPU time when parsing long, malformed coordinate
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
### Summary Pinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.
Trigger.dev: Blind SSRF via alert-channel webhook
### Summary A WEBHOOK alert channel stores a user-supplied `url`. When an alert fires (deployment/run failure, error gr
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
### Summary The run replay `action` function at `apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts` has no
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics...
CVE-2026-104055
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitor
UTMStack before 11.2.16 contains a missing authorization vulnerability in...
CVE-2026-82041
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(),
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote...
CVE-2026-82042
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full admini
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows...
CVE-2026-82044
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make
A specially crafted HTTP POST request to the web administration interface allows an...
CVE-2026-75937
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated...
CVE-2026-82045
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary en
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated...
CVE-2026-82043
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine
UTMStack before 11.2.16 contains a server-side request forgery vulnerability in...
CVE-2026-82040
UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadata
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...
CVE-2026-104988
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enroll
Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross...
CVE-2026-39718
Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to...
CVE-2026-104994
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above