CVE-2026-114058

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2026-114092

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092

Versions of Trigger.dev prior to 4.5.0 are vulnerable to a missing authentication vulnerability in the dashboard run replay route (resources.taskruns.$runParam.replay). The root cause is that the action handler performs no authentication or organization check, relying solely on the friendlyId to ...

CVE-2026-114091

Trigger.dev versions prior to 4.5.0 are vulnerable to a cross-tenant run payload disclosure due to an authorization bypass in the api.v1.runs.$runParam.replay route. The application fails to scope run lookups to the caller's runtime environment, relying solely on the friendlyId. Consequently, an ...

EUVD-2026-106895

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114091 Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114085

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

EUVD-2026-106888

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

CVE-2026-114085 Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

CVE-2026-114085

Trigger.dev versions through 4.7.6 are vulnerable to a missing authentication flaw in the supervisor workload server. The root cause is a lack of ownership verification, allowing workloads to manipulate runs belonging to other deployments. An attacker with network access and a valid run/snapshot ...

CVE-2026-114085 Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

EUVD-2026-107009

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2026-114058

ArcadeDB versions 26.2.1 before 26.10.1 are vulnerable to a missing authorization flaw in the Bolt protocol handler . This vulnerability allows authenticated users to access and read schema metadata for other databases. Specifically, an attacker with credentials for a single database can manipula...

CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

PT-2026-120211

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

PT-2026-120218

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

PT-2026-120184

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2023-26256

CVE-2023-26256 -h get help -u run a single URL -f batch run...

CVE-2023-36123

CVE-2023-36123 For demonstration purposes only. Exploit works on all Versions of Plain Craft Launcher 2. Download Custom.xaml and import into Plain Craft Launcher 2,then click "Run Command". https://github.com/Hex-Dragon/PCL2/assets/140469824/636d1436-a26d-4f54-ad4f-a7b1bb123783...