Veille CVE

Mercredi 21 octobre 2026

2 CVE sur 28

Critique 0 Élevée 12 Moyenne 14 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « triggerdotdev trigger.dev » ✕
  1. CVE-2026-114071 3.1 Faible

    triggerdotdev trigger.dev

    Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.

  2. CVE-2026-114070 3.5 Faible

    triggerdotdev trigger.dev

    Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.