Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

68886

Tracked CVEs

6390

Critical

701

Exploited in wild

5017

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…863
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266

This week's digest →All digests

Feed

30 matches

CVE-2026-114066High· 8.1

1w ago

Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can …

▾ Twilighttriggerdotdev · trigger.devEPSS 0.27%via CVEORG

CVE-2026-114065Medium· 6.5

1w ago

Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {databa…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.36%via CVEORG

CVE-2026-114068High· 8.3PoC

1w ago

Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can sup…

▾ Midnighttriggerdotdev · trigger.devEPSS 0.25%via CVEORG

CVE-2026-114067Medium· 6.5PoC

1w ago

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own sessio…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.31%via CVEORG

CVE-2026-114069High· 8.1

1w ago

Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview e…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.26%via CVEORG

CVE-2026-114070Low· 3.5

1w ago

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public sess…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.30%via CVEORG

CVE-2026-114073Medium· 5.5PoC

1w ago

Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI d…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.13%via CVEORG

CVE-2026-114072Medium· 4.3

1w ago

Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attacker…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.12%via CVEORG

CVE-2026-114071Low· 3.1

1w ago

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attac…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.20%via CVEORG

CVE-2026-114075Medium· 5.4

1w ago

Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.31%via CVEORG

CVE-2026-114074Medium· 5.4

1w ago

Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can confi…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.26%via CVEORG

CVE-2026-114078High· 8.1PoC

1w ago

Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can se…

▾ Midnighttriggerdotdev · trigger.devEPSS 0.30%via CVEORG

CVE-2026-114077High· 7.1PoC

1w ago

Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding …

▾ Midnighttriggerdotdev · trigger.devEPSS 0.35%via CVEORG

CVE-2026-114076Medium· 5.4

1w ago

Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Att…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.24%via CVEORG

CVE-2026-114081High· 7.7

1w ago

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a ba…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.28%via CVEORG

CVE-2026-114080Medium· 5.0

1w ago

Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert …

▾ Sunlittriggerdotdev · trigger.devEPSS 0.34%via CVEORG

CVE-2026-114083High· 8.1PoC

1w ago

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. A…

▾ Midnighttriggerdotdev · trigger.devEPSS 0.35%via CVEORG

CVE-2026-114082High· 8.1

1w ago

Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credenti…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.34%via CVEORG

CVE-2026-114079Medium· 5.4

1w ago

Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by project…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.22%via CVEORG

CVE-2026-114088Medium· 6.5PoC

1w ago

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FO…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.28%via CVEORG

CVE-2026-114084High· 7.7

1w ago

Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.28%via CVEORG

CVE-2026-114087High· 8.1PoC

1w ago

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Una…

▾ Midnighttriggerdotdev · trigger.devEPSS 0.51%via CVEORG

CVE-2026-114086Medium· 5.3

1w ago

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams…

▾ Sunlittriggerdotdev · trigger.devEPSS 0.27%via CVEORG

CVE-2026-114085High· 7.9

1w ago

Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network ac…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.19%via CVEORG

CVE-2026-114092Medium· 6.5PoC

1w ago

Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows…

▾ Twilighttriggerdotdev · trigger.devEPSS 0.59%via CVEORG

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial