Triggerdotdev · product
trigger.dev
37 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 37 is a mark on the map. Named now: 27 to 37, most at risk first.
- Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
- Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
- Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records
- Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
- Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
- Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
- Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
- Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
- Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
- Trigger.dev: Cross-tenant payload poisoning via packet write + replay
- Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP