526281 matches found
CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...
EUVD-2026-106904
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...
CVE-2026-114100
Coraza versions 3.0.4 through 3.8.1 are susceptible to a request body inspection bypass due to a flaw in how the request-body processor selects content types. The system performs an exact comparison of the Content-Type value; consequently, URL-encoded bodies that include media-type parameters (su...
CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send...
CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send...
EUVD-2026-106903
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send...
CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...
CVE-2026-114099
Coraza versions 3.0.0 before 3.8.1 are vulnerable to a WAF Bypass via a JSON Key Collision . The root cause is a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. Unauthenticated attackers ...
CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...
EUVD-2026-106902
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...
CVE-2026-114088
Trigger.dev versions before 4.5.4 are vulnerable to an authentication bypass due to a hardcoded default secret within the /coordinator Socket.IO namespace. This flaw allows unauthenticated attackers to connect using the published coordinator-secret value. Exploitation enables attackers to emit RE...
CVE-2026-114088 Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READYFOREXECUTION to retrieve decrypted run environment variables or...
CVE-2026-114088 Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READYFOREXECUTION to retrieve decrypted run environment variables or...
EUVD-2026-106891
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READYFOREXECUTION to retrieve decrypted run environment variables or...
CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...
CVE-2026-114087
Versions of Trigger.dev prior to 4.5.6 are vulnerable to an authentication bypass in self-hosted Docker Compose deployments. The root cause is the use of hardcoded default secrets from hosting/docker/.env.example, specifically a hardcoded MAGIC_LINK_SECRET . This flaw allows unauthenticated attac...
CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...
EUVD-2026-106890
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...
CLEANSTART-2026-MJ23189 Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
Security vulnerability affects the nodejs-24 package. Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code...
CVE-2026-114078
Trigger.dev versions before 4.5.6 are vulnerable to an authorization bypass within the DeleteTaskScheduleService and SetActiveOnTaskScheduleService components. The root cause is an unscoped friendlyId lookup , which allows authenticated users to delete or disable IMPERATIVE cron schedules belongi...