2026

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compar

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to writ

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allo

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allo

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause in

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out aut

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run rep

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp serv

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allow

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates t

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write acc

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-f

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTask

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resol

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted us

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret v

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to co

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvar

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows su

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach intern

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cach

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-o

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that let

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that all

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache k

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProces

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,