Medium
ghsa-fj2x-mqqp-3v2w
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 12
Reset filters
Medium
ghsa-4672-hwv6-gq62
Trigger.dev: Cross-environment deployment cancel
High
ghsa-9q4r-4842-93vw
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Medium
ghsa-59h8-w5q6-mfmp
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
High
ghsa-pqxw-g93w-hj9x
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Critical
ghsa-gg6r-gp4c-89hp
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Medium
ghsa-q567-cr4x-96w4
Trigger.dev: Blind SSRF via alert-channel webhook
High
ghsa-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
High
CVE-2026-85650
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
High
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
Medium
CVE-2026-48819
@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.