#CVE

共收录 69534 条相关情报。

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without envir...

CVE-2026-114077

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resol

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal ho...

CVE-2026-114076

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the leg...

CVE-2026-114075

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted us

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-...

CVE-2026-114074

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布INFO

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted ...

CVE-2026-114073

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret v

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-10-21 发布INFO

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth ...

CVE-2026-114072

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-21 发布LOW

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint...

CVE-2026-114071

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to co

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable s...

CVE-2026-114070

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key ...

CVE-2026-114069

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvar

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other...

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presi...

CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a for...

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /...

CVE-2026-114065

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-21 发布MEDIUM

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, incl...

CVE-2026-114064

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows su

来源摘录 · NVD

#cve #cwe-203

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read fi...

CVE-2026-114063

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布INFO

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redi...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach intern

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-21 发布MEDIUM

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted wit...

CVE-2026-114061

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cach

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. At...

CVE-2026-114060

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-21 发布HIGH

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because G...

CVE-2026-114059

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-o

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metada...

CVE-2026-114058

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that let

历史摘要 · 未重新核验 · NVD

#cve #cwe-862