122609 matches found
CVE-2026-73658
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...
CVE-2026-73658 Trigger.dev: Cross-tenant object store read and write via URL path traversal
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...
EUVD-2026-58480
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...
CVE-2026-73658
Trigger.dev CVE-2026-73658 affects versions 4.4.2 through 4.5.0-rc.5 where Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() assign user-controlled packet keys to URL.pathname, and routes/api.v1.packets.$.ts accepts wildcard params with insufficient per-resource ownership checks. WHATWG pa...
CVE-2026-73658 Trigger.dev: Cross-tenant object store read and write via URL path traversal
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...
Malicious code in eslint-generate-prerelease (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...
MAL-2026-13979 Malicious code in eslint-generate-prerelease (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...
CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-72777
Next AI Draw.io
CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...
CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...
CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...
CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...
sage v0.12.0
Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...
CVE-2026-73671 Saurus CMS Unauthenticated Open Redirect via logout url parameter
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...
CVE-2026-49857
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...
EUVD-2026-58054
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...