Trigger.dev: Unauthenticated Realtime Stream Data Injection Via Run FriendlyId

Summary The POST handler for "/realtime/v1/streams/:runId/:streamId" has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: "apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts" The "actio...

PT-2026-111183

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

EUVD-2026-84538

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75517

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

PT-2026-96822

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu provides an API for sending notifications through multiple channels. Certain integration mutation use cases fail to consistently enforce the environmentId when looking up an integration by...

CVE-2026-13210

GitLab CE/EE is affected by an improper input validation flaw in the environment scope pattern matcher for CI/CD variables. An authenticated user could access CI/CD variables outside their intended environment scope under certain conditions. The issue affects versions from 15.7 before 19.1.8 , 19...

CVE-2018-9039: Missing Authorization

In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments...