CVE-2026-114067

Versions of Trigger.dev prior to 4.6.2 (specifically 4.5.0 ) are vulnerable to an improper authorization flaw in the PUT snapshot-url session endpoint. The root cause is the absence of a secret-key-only check on this route, which allows public session token holders to obtain presigned S3 write UR...

EUVD-2026-107018

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to an open redirect vulnerability within the enhanced form actions (use:enhance). The issue occurs on routes that accept paths starting with a double slash (//). Attackers can craft action paths starting with // to create protocol-re...

PT-2026-120206

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...

PT-2026-120193

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

PT-2026-120186

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description An open redirect issue exists in enhanced form actions use:enhance on routes that accept paths starting with a double slash. Attackers can create action paths beginning with // that...

PT-2026-120677

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5 Description Requests to open external protocol URLs can be attributed to a document other than the...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the xsrfInterceptorFn in packages/common/http/src/xsrf.ts, where the XSRF interceptor skips token injection for all absolute URLs, including those that share the same...

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

GHSA-CV27-6WVH-8X7J ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661

The ApostropheCMS content management system is affected by a vulnerability in the sanitize-html library. Prior to version 2.18.0 , a non-default configuration allowing meta refresh elements could retain unsafe javascript: or data: URLs within the content attribute. This flaw can lead to unsafe sc...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-107755 Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...