Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from...
CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp
#cwe-653
共收录 30 条相关情报。
← 返回所有主题Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGI...
CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated...
CVE-2026-109443
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants...
CVE-2026-109441
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copil...
CVE-2026-109443
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-contai...
CVE-2026-109441
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /...
CVE-2026-108263
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow co
Ghost: Stored XSS via Embed Card Previews
CVE-2026-105643
### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, inc
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss...
CVE-2026-106588
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
CVE-2026-106588
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any...
CVE-2026-105643
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could by
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
## Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default s
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potenti...
CVE-2026-102125
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share th...
CVE-2026-97029
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of th...
CVE-2026-101078
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users...
CVE-2026-95699
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() o...
CVE-2026-57135
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page
CVE-2026-15366
本漏洞涉及 Kids Mode（儿童模式）中一个内置网页的控制逻辑缺陷。该缺陷允许用户直接在页面内查看本地图库中的照片，无需额外授权，从而绕过了儿童模式对敏感内容（如本地媒体文件）的访问限制。从技术角度看，这属于一种访问控制或逻辑校验不严的
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references a...
CVE-2026-71325
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25
Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
CVE-2026-71325
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25