Search
37,354 CVEs · High severity
CVEs (37,354, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 37,354 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-114090 | HIGH | Patched | 7.1 | 2026-10-21 | Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes t… |
| CVE-2026-114089 | HIGH | Patched | 8.8 | 2026-10-21 | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a P… |
| CVE-2026-114088 | HIGH | Patched | 6.5 | 2026-10-21 | Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using th… |
| CVE-2026-114085 | HIGH | 7.9 | 2026-10-21 | Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other depl… | |
| CVE-2026-114084 | HIGH | Patched | 7.7 | 2026-10-21 | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricS… |
| CVE-2026-114083 | HIGH | Patched | 8.1 | 2026-10-21 | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their o… |
| CVE-2026-114082 | HIGH | Patched | 8.1 | 2026-10-21 | Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials… |
| CVE-2026-114081 | HIGH | Patched | 7.7 | 2026-10-21 | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without … |
| CVE-2026-114078 | HIGH | Patched | 8.1 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to d… |
| CVE-2026-114069 | HIGH | Patched | 8.1 | 2026-10-21 | Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API… |
| CVE-2026-114068 | HIGH | Patched | 8.3 | 2026-10-21 | Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to … |
| CVE-2026-114067 | HIGH | Patched | 6.5 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain … |
| CVE-2026-114066 | HIGH | Patched | 8.1 | 2026-10-21 | Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying … |
| CVE-2026-114065 | HIGH | Patched | 6.5 | 2026-10-21 | Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in P… |
| CVE-2026-114063 | HIGH | Patched | 7.5 | 2026-10-21 | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to re… |
| CVE-2026-114059 | HIGH | Patched | 7.5 | 2026-10-21 | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code beca… |
| CVE-2026-114055 | HIGH | Patched | 7.5 | 2026-10-21 | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying… |
| CVE-2026-114054 | HIGH | Patched | 6.5 | 2026-10-21 | vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EX… |
| CVE-2026-114052 | HIGH | Patched | 7.5 | 2026-10-21 | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_… |
| CVE-2026-114051 | HIGH | Patched | 7.5 | 2026-10-21 | vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an unca… |
| CVE-2026-114050 | HIGH | Patched | 7.5 | 2026-10-21 | vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attac… |
| CVE-2026-114047 | HIGH | Patched | 6.8 | 2026-10-21 | FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification … |
| CVE-2026-114046 | HIGH | Patched | 6.5 | 2026-10-21 | FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A m… |
| CVE-2026-114045 | HIGH | Patched | 8.8 | 2026-10-21 | FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block… |
| CVE-2026-114043 | HIGH | Patched | 6.5 | 2026-10-21 | FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buff… |