https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T09:15:12.306333+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114070 CVE-2026-114070 — Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records 2026-10-23T09:15:12.307347+00:00

Affected: triggerdotdev trigger.dev

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.