CVE-2026-114093

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

CVE-2026-114091

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

EUVD-2026-106894

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

EUVD-2026-106895

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114090 Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task...

CVE-2026-114090 Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task...

CVE-2026-114090

The Trigger.dev cli-v3 (versions 3.0.0 before 4.5.4 ) is vulnerable to a missing authentication flaw in the trigger dev --mcp server. The server binds to all network interfaces, exposing the /sse and /messages endpoints. This allows LAN attackers or malicious web pages to send MCP tools/call requ...

CVE-2026-114051 vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

vLLM before 0.31.0 skips the mintokens = maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized...

CVE-2026-114051

The vLLM library (versions before 0.31.0 ) is vulnerable to a Denial of Service (DoS) condition. The flaw occurs because the system skips the min_tokens

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050

Versions of vLLM before 0.31.0 are vulnerable to a remote engine crash due to insufficient verification of data authenticity (CWE-345 ). The software uses a client-supplied multimodal uuid as a cache identity without performing any consistency checks on cache hits. This allows unauthenticated att...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114049

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowedtokenids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycl...

cve-2026-21509-mitigation

CVE-2026-21509 Mitigation Script Traditional Chinese version: READMEzh-TW.md Overview This script applies a registry-based mitigation to protect against CVE-2026-21509 Microsoft Office security feature bypass vulnerability, which has been exploited in the wild. CVE ID: CVE-2026-21509 Severity:...

EUVD-2026-106879

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlinksetrootpwd of the file /mnt/mtd/aoniipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of...

EUVD-2026-106872

A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called...

EUVD-2026-106849

Vulnerability in Oracle Essbase component: Java Based Agent. The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability...

EUVD-2026-106836

Vulnerability in Oracle Essbase component: Java Based Agent. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability ...

EUVD-2026-106820

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in...