# triggerdotdev trigger.dev.

Every CVE that names triggerdotdev trigger.dev among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint](https://agentprime.io/advisories/CVE-2026-114093.md)
  `CVE-2026-114093` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action](https://agentprime.io/advisories/CVE-2026-114092.md)
  `CVE-2026-114092` · CVE record: triggerdotdev trigger.dev · CVSS 8.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route](https://agentprime.io/advisories/CVE-2026-114091.md)
  `CVE-2026-114091` · CVE record: triggerdotdev trigger.dev · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover](https://agentprime.io/advisories/CVE-2026-114089.md)
  `CVE-2026-114089` · CVE record: triggerdotdev trigger.dev · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API](https://agentprime.io/advisories/CVE-2026-114085.md)
  `CVE-2026-114085` · CVE record: triggerdotdev trigger.dev · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API](https://agentprime.io/advisories/CVE-2026-114084.md)
  `CVE-2026-114084` · CVE record: triggerdotdev trigger.dev · CVSS 8.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection
- [Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints](https://agentprime.io/advisories/CVE-2026-114083.md)
  `CVE-2026-114083` · CVE record: triggerdotdev trigger.dev · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal
- [Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials](https://agentprime.io/advisories/CVE-2026-114082.md)
  `CVE-2026-114082` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL](https://agentprime.io/advisories/CVE-2026-114080.md)
  `CVE-2026-114080` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup](https://agentprime.io/advisories/CVE-2026-114078.md)
  `CVE-2026-114078` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4](https://agentprime.io/advisories/CVE-2026-114077.md)
  `CVE-2026-114077` · CVE record: triggerdotdev trigger.dev · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API](https://agentprime.io/advisories/CVE-2026-114075.md)
  `CVE-2026-114075` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range](https://agentprime.io/advisories/CVE-2026-114074.md)
  `CVE-2026-114074` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State](https://agentprime.io/advisories/CVE-2026-114072.md)
  `CVE-2026-114072` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route](https://agentprime.io/advisories/CVE-2026-114071.md)
  `CVE-2026-114071` · CVE record: triggerdotdev trigger.dev · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records](https://agentprime.io/advisories/CVE-2026-114070.md)
  `CVE-2026-114070` · CVE record: triggerdotdev trigger.dev · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint](https://agentprime.io/advisories/CVE-2026-114069.md)
  `CVE-2026-114069` · CVE record: triggerdotdev trigger.dev · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint](https://agentprime.io/advisories/CVE-2026-114068.md)
  `CVE-2026-114068` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route](https://agentprime.io/advisories/CVE-2026-114067.md)
  `CVE-2026-114067` · CVE record: triggerdotdev trigger.dev · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints](https://agentprime.io/advisories/CVE-2026-114066.md)
  `CVE-2026-114066` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders](https://agentprime.io/advisories/CVE-2026-114065.md)
  `CVE-2026-114065` · CVE record: triggerdotdev trigger.dev · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection
- [Trigger.dev before 4.6.0 GitHub App Installation Takeover](https://agentprime.io/advisories/CVE-2026-92773.md)
  `CVE-2026-92773` · CVE record: triggerdotdev trigger.dev · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API](https://agentprime.io/advisories/CVE-2026-73659.md)
  `CVE-2026-73659` · CVE record: triggerdotdev trigger.dev · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [Trigger.dev: Cross-tenant object store read and write via URL path traversal](https://agentprime.io/advisories/CVE-2026-73658.md)
  `CVE-2026-73658` · CVE record: triggerdotdev trigger.dev · CVSS 8.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Broken access control, CWE-20
- [Trigger.dev: Cross-tenant payload poisoning via packet write + replay](https://agentprime.io/advisories/CVE-2026-73657.md)
  `CVE-2026-73657` · CVE record: triggerdotdev trigger.dev · CVSS 4.2 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Broken access control, CWE-345
- [Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state](https://agentprime.io/advisories/CVE-2026-73656.md)
  `CVE-2026-73656` · CVE record: triggerdotdev trigger.dev · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control
- [Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login](https://agentprime.io/advisories/CVE-2026-73655.md)
  `CVE-2026-73655` · CVE record: triggerdotdev trigger.dev · CVSS 7.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=triggerdotdev-trigger-dev>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/triggerdotdev-trigger-dev/>. Everything for agents: <https://agentprime.io/llms.txt>.