https://vulnogram.org/ Most recent CVEs assigned by VulnCheck (vulncheck). https://vulnogram.org/seaview/icons/vulncheck.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-114119 https://vulnogram.org/CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the da… Critical Network Exploitable Wed, 21 Oct 2026 00:37:16 GMT https://vulnogram.org/CVE-2026-114118 https://vulnogram.org/CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacke… Medium Network Exploitable Wed, 21 Oct 2026 00:37:15 GMT https://vulnogram.org/CVE-2026-114117 https://vulnogram.org/CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default… High Network Exploitable Wed, 21 Oct 2026 00:37:14 GMT https://vulnogram.org/CVE-2026-114116 https://vulnogram.org/CVE-2026-114116 Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated f… Medium Network Exploitable Wed, 21 Oct 2026 00:37:13 GMT https://vulnogram.org/CVE-2026-114115 https://vulnogram.org/CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after… Medium Network Exploitable Wed, 21 Oct 2026 00:37:13 GMT https://vulnogram.org/CVE-2026-114114 https://vulnogram.org/CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric l… Medium Network Exploitable Wed, 21 Oct 2026 00:37:12 GMT https://vulnogram.org/CVE-2026-114113 https://vulnogram.org/CVE-2026-114113 Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF… High Wed, 21 Oct 2026 00:37:11 GMT https://vulnogram.org/CVE-2026-114112 https://vulnogram.org/CVE-2026-114112 Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing un… High Wed, 21 Oct 2026 00:37:11 GMT https://vulnogram.org/CVE-2026-114111 https://vulnogram.org/CVE-2026-114111 sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image… High Wed, 21 Oct 2026 00:37:10 GMT https://vulnogram.org/CVE-2026-114110 https://vulnogram.org/CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files o… High Network Exploitable Wed, 21 Oct 2026 00:37:09 GMT https://vulnogram.org/CVE-2026-114109 https://vulnogram.org/CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel… High Network Exploitable Wed, 21 Oct 2026 00:37:08 GMT https://vulnogram.org/CVE-2026-114108 https://vulnogram.org/CVE-2026-114108 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post message… Critical Network Exploitable Wed, 21 Oct 2026 00:37:08 GMT https://vulnogram.org/CVE-2026-114107 https://vulnogram.org/CVE-2026-114107 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and Backgro… High Network Exploitable Wed, 21 Oct 2026 00:37:07 GMT https://vulnogram.org/CVE-2026-114106 https://vulnogram.org/CVE-2026-114106 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sand… High Network Exploitable Wed, 21 Oct 2026 00:37:06 GMT https://vulnogram.org/CVE-2026-114105 https://vulnogram.org/CVE-2026-114105 Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes tha… Medium Wed, 21 Oct 2026 00:37:06 GMT https://vulnogram.org/CVE-2026-114104 https://vulnogram.org/CVE-2026-114104 adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last dupli… High Network Exploitable Wed, 21 Oct 2026 00:37:05 GMT https://vulnogram.org/CVE-2026-114103 https://vulnogram.org/CVE-2026-114103 adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small decl… Medium Network Exploitable Wed, 21 Oct 2026 00:37:04 GMT https://vulnogram.org/CVE-2026-114102 https://vulnogram.org/CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can… High Network Exploitable Wed, 21 Oct 2026 00:37:03 GMT https://vulnogram.org/CVE-2026-114101 https://vulnogram.org/CVE-2026-114101 Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso… Medium Network Exploitable Wed, 21 Oct 2026 00:37:03 GMT https://vulnogram.org/CVE-2026-114100 https://vulnogram.org/CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed… Medium Network Exploitable Wed, 21 Oct 2026 00:37:02 GMT https://vulnogram.org/CVE-2026-114099 https://vulnogram.org/CVE-2026-114099 Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such… Medium Network Exploitable Wed, 21 Oct 2026 00:37:01 GMT https://vulnogram.org/CVE-2026-114098 https://vulnogram.org/CVE-2026-114098 Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose p… High Wed, 21 Oct 2026 00:37:01 GMT https://vulnogram.org/CVE-2026-114097 https://vulnogram.org/CVE-2026-114097 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repositor… High Wed, 21 Oct 2026 00:37:00 GMT https://vulnogram.org/CVE-2026-114096 https://vulnogram.org/CVE-2026-114096 Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree… High Wed, 21 Oct 2026 00:36:59 GMT https://vulnogram.org/CVE-2026-114095 https://vulnogram.org/CVE-2026-114095 Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset… High Network Exploitable Wed, 21 Oct 2026 00:36:59 GMT https://vulnogram.org/CVE-2026-114094 https://vulnogram.org/CVE-2026-114094 Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes fil… High Network Exploitable Wed, 21 Oct 2026 00:36:58 GMT https://vulnogram.org/CVE-2026-114093 https://vulnogram.org/CVE-2026-114093 Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-… Medium Network Exploitable Wed, 21 Oct 2026 00:36:57 GMT https://vulnogram.org/CVE-2026-114092 https://vulnogram.org/CVE-2026-114092 Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's r… High Network Exploitable Wed, 21 Oct 2026 00:36:56 GMT https://vulnogram.org/CVE-2026-114091 https://vulnogram.org/CVE-2026-114091 Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can repl… Medium Wed, 21 Oct 2026 00:36:56 GMT https://vulnogram.org/CVE-2026-114090 https://vulnogram.org/CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send… High Wed, 21 Oct 2026 00:36:55 GMT https://vulnogram.org/CVE-2026-114089 https://vulnogram.org/CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticat… High Network Exploitable Wed, 21 Oct 2026 00:36:54 GMT https://vulnogram.org/CVE-2026-114088 https://vulnogram.org/CVE-2026-114088 Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION t… High Network Exploitable Wed, 21 Oct 2026 00:36:54 GMT https://vulnogram.org/CVE-2026-114087 https://vulnogram.org/CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated… Critical Network Exploitable Wed, 21 Oct 2026 00:36:53 GMT https://vulnogram.org/CVE-2026-114086 https://vulnogram.org/CVE-2026-114086 Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:stre… Medium Network Exploitable Wed, 21 Oct 2026 00:36:52 GMT https://vulnogram.org/CVE-2026-114085 https://vulnogram.org/CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a va… High Wed, 21 Oct 2026 00:36:52 GMT https://vulnogram.org/CVE-2026-114084 https://vulnogram.org/CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authe… High Wed, 21 Oct 2026 00:36:51 GMT https://vulnogram.org/CVE-2026-114083 https://vulnogram.org/CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers hold… High Wed, 21 Oct 2026 00:36:50 GMT https://vulnogram.org/CVE-2026-114082 https://vulnogram.org/CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly a… High Wed, 21 Oct 2026 00:36:49 GMT https://vulnogram.org/CVE-2026-114081 https://vulnogram.org/CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted… High Wed, 21 Oct 2026 00:36:49 GMT https://vulnogram.org/CVE-2026-114080 https://vulnogram.org/CVE-2026-114080 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels poin… Medium Wed, 21 Oct 2026 00:36:48 GMT https://vulnogram.org/CVE-2026-114079 https://vulnogram.org/CVE-2026-114079 Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Atta… Medium Wed, 21 Oct 2026 00:36:47 GMT https://vulnogram.org/CVE-2026-114078 https://vulnogram.org/CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or… High Wed, 21 Oct 2026 00:36:47 GMT https://vulnogram.org/CVE-2026-114077 https://vulnogram.org/CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their ow… High Wed, 21 Oct 2026 00:36:46 GMT https://vulnogram.org/CVE-2026-114076 https://vulnogram.org/CVE-2026-114076 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can po… Medium Wed, 21 Oct 2026 00:36:45 GMT https://vulnogram.org/CVE-2026-114075 https://vulnogram.org/CVE-2026-114075 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST… Medium Wed, 21 Oct 2026 00:36:45 GMT https://vulnogram.org/CVE-2026-114074 https://vulnogram.org/CVE-2026-114074 Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-ch… Medium Wed, 21 Oct 2026 00:36:44 GMT https://vulnogram.org/CVE-2026-114073 https://vulnogram.org/CVE-2026-114073 Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or… Medium Wed, 21 Oct 2026 00:36:43 GMT https://vulnogram.org/CVE-2026-114072 https://vulnogram.org/CVE-2026-114072 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a… Medium Network Exploitable Wed, 21 Oct 2026 00:36:43 GMT https://vulnogram.org/CVE-2026-114071 https://vulnogram.org/CVE-2026-114071 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know… Low Wed, 21 Oct 2026 00:36:42 GMT https://vulnogram.org/CVE-2026-114070 https://vulnogram.org/CVE-2026-114070 Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can… Medium Wed, 21 Oct 2026 00:36:41 GMT