CVE-2026-114078

Trigger.dev versions before 4.5.6 are vulnerable to an authorization bypass within the DeleteTaskScheduleService and SetActiveOnTaskScheduleService components. The root cause is an unscoped friendlyId lookup , which allows authenticated users to delete or disable IMPERATIVE cron schedules belongi...

CVE-2026-114079

The software Trigger.dev versions prior to 4.5.6 is vulnerable to an improper authorization flaw (CWE-639). The issue exists because the DeploymentService.getDeployment scopes perform lookups based solely on projectId, failing to restrict actions by environment trust levels. Consequently, an atta...

EUVD-2026-107029

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's...

EUVD-2026-106882

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

CVE-2026-114077

Versions of Trigger.dev prior to 4.5.6 are vulnerable to an authorization bypass within the createDeploymentBackgroundWorkerV4 function. The root cause is that the system resolves a WorkerDeployment using only its friendlyId without verifying the environment, project, or organization scope. This ...

EUVD-2026-107028

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...

CVE-2026-114075

Versions of Trigger.dev before 4.5.12 are vulnerable to an authorization bypass (CWE-863) via the Alert Channels API . This flaw allows holders of capability-restricted user-actor tokens to utilize the legacy personal access token helper to create alert channels. Specifically, an attacker with a ...

EUVD-2026-107026

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...

CVE-2026-114071

Versions of Trigger.dev prior to 4.5.12 are vulnerable to an authorization bypass within the waitpoint complete route. The root cause is a failure to perform a per-user environment ownership check, allowing authenticated project members to interact with other members' DEVELOPMENT environment wait...

EUVD-2026-107022

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

CVE-2026-114069

The software Trigger.dev before version 4.6.0 is affected by an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint. This flaw allows attackers possessing a restricted read:envvars key to access the environment's root API key (labeled as TRIGGER_SECRET_KE...

CVE-2026-114068

Versions of Trigger.dev prior to 4.6.0 are vulnerable to a missing authorization flaw in the waitpoint token wait endpoint . An authenticated attacker possessing any secret API key can provide a victim run ID associated with another organization and link it to their own waitpoint. This allows the...

EUVD-2026-107020

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...

EUVD-2026-107019

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that r...

CVE-2026-114067

Versions of Trigger.dev prior to 4.6.2 (specifically 4.5.0 ) are vulnerable to an improper authorization flaw in the PUT snapshot-url session endpoint. The root cause is the absence of a secret-key-only check on this route, which allows public session token holders to obtain presigned S3 write UR...

EUVD-2026-107018

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114066

The software Trigger.dev before version 4.7.0 is vulnerable to a missing authorization flaw (CWE-639). Holders of unrestricted environment API keys can block runs they do not own by providing a foreign parentRunId to batch-creation endpoints. Specifically, an attacker can send requests to POST /a...

EUVD-2026-107017

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

CVE-2026-114058

ArcadeDB versions 26.2.1 before 26.10.1 are vulnerable to a missing authorization flaw in the Bolt protocol handler . This vulnerability allows authenticated users to access and read schema metadata for other databases. Specifically, an attacker with credentials for a single database can manipula...

EUVD-2026-107009

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...