PT-2026-71880

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-14456: Allocation of Resources Without Limits or Throttling

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-73039: Authorization Bypass Through User-Controlled Key

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...

CVE-2026-73658: Improper Input Validation

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-72850: Improper Limitation of a Pathname to a Restricted Directory

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-14668: Access of Resource Using Incompatible Type

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-71513

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

PT-2026-71514

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

PT-2026-71879

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of skb...

Vulnerability in core server (CVE-2026-15741)

PostgreSQL expression deparse allows SQL injection via EXTRACT argument SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands...

CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

EUVD-2026-39535

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access...

GHSA-Q4C3-7575-55J2 Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...