CVE-2026-114071 Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

CVE-2026-114071

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

EUVD-2026-107022

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

EUVD-2026-105911

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Siebel Approval Manager. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development...

EUVD-2026-105871

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Integration - Scripting. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes...

PT-2026-120197

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

CVE-2026-101454

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to...

CVE-2026-101456

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Development executes to...

CVE-2026-101455

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Integration - Scripting. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes...

CVE-2026-101456

A vulnerability exists in the Configuration Tools component of Oracle Siebel CRM Development (affected versions 17.0-26.9 ). A high-privileged attacker with access to the infrastructure where the software executes can exploit this flaw to compromise the system. Successful exploitation may lead to...

CVE-2026-101454

A vulnerability exists in the Configuration Tools component of Oracle Siebel CRM (Siebel CRM Development product), affecting supported versions 17.0-26.9 . A low-privileged attacker with infrastructure access can exploit this flaw to compromise the product. Successful exploitation may lead to una...

CVE-2026-101455

A vulnerability exists in the Integration - Scripting component of Oracle Siebel CRM Development (supported versions 17.0-26.9 ). A low-privileged attacker with infrastructure access can exploit this difficult-to-execute flaw to compromise the system, potentially resulting in unauthorized creatio...

CVE-2026-112949

A flaw was found in Vitest. An unauthenticated attacker able to connect to the development server can achieve cross-site scripting XSS by registering a crafted mock module with an unescaped URL. When a developer loads the affected module in their browser, attacker-controlled JavaScript executes...

CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

CopyFail-Experiment

Just an experiment to verify that the LLM can find this vuln and construct a working exploit. Usage gcc -o poc poc.c ./poc...

CVE-2026-112946

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112946

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Muhammad Waseem. Usage: python viteexploit.py -u http://target.com python viteexploit.py...