CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

EUVD-2026-107018

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

PT-2026-120205

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

PT-2026-120193

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

PT-2026-120521

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure ACI before build 6.0.1-112, Acronis Cyber Infrastructure ACI before build 6.1.1-64, Acronis Cyber Infrastructure ACI before build 6.2.1-71...

PT-2026-120611

A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. Th...

PT-2026-120572

A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form...

PT-2026-120195

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER SECRET KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key...

PT-2026-120565

Improper authorization in Apache bRPC versions 1.18.0 on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal port is documented to make builtin services and Tabbed services reachable only from the internal port, and the...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an improper authorization flaw (CWE-285) that allows an unauthenticated user to perform an arbitrary write into the shared Redis instance. This vulnerability allows an anonymous caller to write data under any tenant's key, effectively c...

CVE-2026-113411

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

EUVD-2026-105022

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-113411

A vulnerability exists in Nerimity Desktop up to version 2.2.2 within the Window Open Handler component. Specifically, the shell.openExternal function in src/mainWindow.js fails to properly authorize custom URL schemes when the url argument is manipulated. This flaw allows for remote execution of...

CVE-2026-54121

🛡️ CVE-2026-54121 — Certighost CTI Investigation Active Directory Certificate Services Privilege Escalation / Domain Compromise Risk Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot Field| Finding ---|--- CVE| CVE-2026-54121 Name| Certighost Vendor| Microsoft Component| Activ...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357

The @e2e-dev/github package version before 0.4.1 is vulnerable to an improper authorization vulnerability (CWE-863) that allows for CI report hijacking . The root cause is located in the findComment and upsertComment functions within post.ts, which fail to verify the comment author. Consequently,...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...