Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Every public CVE, as it is published

The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.

At a glance

Published CVEs; rejected ones are not counted.

  • 401,334All CVEsplus 19,141 rejected
  • 442Last 24 hours2,721 in the last 7 days
  • 16,921Last 30 days1,562 of them critical
  • 1,768Known exploitedin the CISA KEV catalog

CVEs published per year

All time, by publication date in UTC; follows the filter above.

  • Critical
  • High
  • Medium
  • Low
  • Not scored
The numbers of every bucket are in the table under the chart.
Show the numbers as a table
Matching CVEs per period and severity, newest first
PeriodCriticalHighMediumLowNot scoredTotalCumulative
202622014103737

Latest CVEs

37 CVEs, newest first

CVEs, newest first
Title
CVE-2026-114093
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpointtriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114092
Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Actiontriggerdotdev · trigger.dev
High8.3
CVE-2026-114091
Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Routetriggerdotdev · trigger.dev
Medium6.0
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeovertriggerdotdev · trigger.dev
High8.7
CVE-2026-114088
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOtriggerdotdev · trigger.dev
High8.3
CVE-2026-114087
Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev · trigger.dev
Critical9.2
CVE-2026-114086
Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpointtriggerdotdev · trigger.dev
Medium6.9
CVE-2026-114085
Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload APItriggerdotdev · trigger.dev
High8.8
CVE-2026-114084
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs APItriggerdotdev · trigger.dev
High8.3
CVE-2026-114083
Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpointstriggerdotdev · trigger.dev
High8.6
CVE-2026-114082
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentialstriggerdotdev · trigger.dev
High7.2
CVE-2026-114081
Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Nametriggerdotdev · trigger.dev
High8.3
CVE-2026-114080
Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URLtriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114079
Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpointtriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114078
Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookuptriggerdotdev · trigger.dev
High7.2
CVE-2026-114077
Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4triggerdotdev · trigger.dev
Medium6.1
CVE-2026-114076
Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URLtriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114075
Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels APItriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114074
Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Rangetriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114073
Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logstriggerdotdev · trigger.dev
Medium6.8
CVE-2026-114072
Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback Statetriggerdotdev · trigger.dev
Medium5.3
CVE-2026-114071
Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Routetriggerdotdev · trigger.dev
Low2.3
CVE-2026-114070
Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Recordstriggerdotdev · trigger.dev
Medium5.1
CVE-2026-114069
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpointtriggerdotdev · trigger.dev
High8.6
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpointtriggerdotdev · trigger.dev
High7.2
CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Routetriggerdotdev · trigger.dev
High7.1
CVE-2026-114066
Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpointstriggerdotdev · trigger.dev
High7.2
CVE-2026-114065
Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholderstriggerdotdev · trigger.dev
High7.1
CVE-2026-92773
Trigger.dev before 4.6.0 GitHub App Installation Takeovertriggerdotdev · trigger.dev
High7.1
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replaytriggerdotdev · trigger.dev
High8.4
CVE-2026-85650
Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channeltriggerdotdev · trigger.dev
Medium5.3
CVE-2026-73659
Trigger.dev: Cross-tenant object read/write via path traversal in packet presign APItriggerdotdev · trigger.dev
High8.1
CVE-2026-73658
Trigger.dev: Cross-tenant object store read and write via URL path traversaltriggerdotdev · trigger.dev
High8.2
CVE-2026-73657
Trigger.dev: Cross-tenant payload poisoning via packet write + replaytriggerdotdev · trigger.dev
Medium4.2
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment statetriggerdotdev · trigger.dev
Critical9.9
CVE-2026-73655
Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Logintriggerdotdev · trigger.dev
High7.4
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoStriggerdotdev · trigger.dev
High8.5