Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,751 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-114085 | 8.8 High | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API | Oct 21, 2026 |
| CVE-2026-114084 | 8.3 High | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API | Oct 21, 2026 |
| CVE-2026-114083 | 8.6 High | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints | Oct 21, 2026 |
| CVE-2026-114082 | 7.2 High | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials | Oct 21, 2026 |
| CVE-2026-114081 | 8.3 High | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name | Oct 21, 2026 |
| CVE-2026-114080 | 5.3 Medium | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL | Oct 21, 2026 |
| CVE-2026-114079 | 5.3 Medium | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint | Oct 21, 2026 |
| CVE-2026-114078 | 7.2 High | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup | Oct 21, 2026 |
| CVE-2026-114077 | 6.1 Medium | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 | Oct 21, 2026 |
| CVE-2026-114076 | 5.3 Medium | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL | Oct 21, 2026 |
| CVE-2026-114075 | 5.3 Medium | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API | Oct 21, 2026 |
| CVE-2026-114074 | 5.3 Medium | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range | Oct 21, 2026 |
| CVE-2026-114073 | 6.8 Medium | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs | Oct 21, 2026 |
| CVE-2026-114072 | 5.3 Medium | Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State | Oct 21, 2026 |
| CVE-2026-114071 | 2.3 Low | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route | Oct 21, 2026 |
| CVE-2026-114070 | 5.1 Medium | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records | Oct 21, 2026 |
| CVE-2026-114069 | 8.6 High | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint | Oct 21, 2026 |
| CVE-2026-114068 | 7.2 High | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint | Oct 21, 2026 |
| CVE-2026-114067 | 7.1 High | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route | Oct 21, 2026 |
| CVE-2026-114066 | 7.2 High | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints | Oct 21, 2026 |
| CVE-2026-114065 | 7.1 High | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders | Oct 21, 2026 |
| CVE-2026-114064 | 5.1 Medium | Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint | Oct 21, 2026 |
| CVE-2026-114063 | 8.7 High | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | Oct 21, 2026 |
| CVE-2026-114062 | 6.9 Medium | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks | Oct 21, 2026 |
| CVE-2026-114061 | 2.3 Low | SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages | Oct 21, 2026 |
| CVE-2026-114060 | 2.1 Low | SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions | Oct 21, 2026 |
| CVE-2026-114059 | 7.7 High | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization | Oct 21, 2026 |
| CVE-2026-114058 | 5.3 Medium | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol | Oct 21, 2026 |
| CVE-2026-114057 | 5.3 Medium | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure | Oct 21, 2026 |
| CVE-2026-114056 | 5.3 Medium | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH | Oct 21, 2026 |
| CVE-2026-114055 | 8.7 High | vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs | Oct 21, 2026 |
| CVE-2026-114054 | 7.1 High | vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys | Oct 21, 2026 |
| CVE-2026-114053 | 9.2 Critical | vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision | Oct 21, 2026 |
| CVE-2026-114052 | 8.7 High | vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs | Oct 21, 2026 |
| CVE-2026-114051 | 7.1 High | vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate | Oct 21, 2026 |
| CVE-2026-114050 | 7.1 High | vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID | Oct 21, 2026 |
| CVE-2026-114049 | 6.3 Medium | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense | Oct 21, 2026 |
| CVE-2026-114048 | 5.1 Medium | WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints | Oct 21, 2026 |
| CVE-2026-114047 | 7.6 High | FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation | Oct 21, 2026 |
| CVE-2026-114046 | 7.1 High | FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard | Oct 21, 2026 |
| CVE-2026-114045 | 8.7 High | FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format | Oct 21, 2026 |
| CVE-2026-114044 | 6.9 Medium | FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline | Oct 21, 2026 |
| CVE-2026-114043 | 7.1 High | Vulnerability in FreeRDP | Oct 21, 2026 |
| CVE-2026-114042 | 7.1 High | FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU | Oct 21, 2026 |
| CVE-2026-114041 | 6.9 Medium | FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message | Oct 21, 2026 |
| CVE-2025-71437 | 8.7 High | Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction | Oct 21, 2026 |
| CVE-2021-48020 | 8.3 High | Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays | Oct 21, 2026 |
| CVE-2021-48019 | 6.3 Medium | Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies | Oct 21, 2026 |
| CVE-2021-48018 | 8.3 High | Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator | Oct 21, 2026 |
| CVE-2020-37289 | 6.3 Medium | Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.