https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 23:16:02 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114092 <p>Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim&#39;s run friendlyId can replay it into an environment of their choosing, exposing the victim&#39;s task payload or running the task again with the victim&#39;s secrets.</p> <p>Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim&#39;s run friendlyId can replay it into an environment of their choosing, exposing the victim&#39;s task payload or running the task again with the victim&#39;s secrets.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114092 https://db.gcve.eu/vuln/ghsa-4ggh-4c33-wrjj <p>Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim&#39;s run friendlyId can replay it into an environment of their choosing, exposing the victim&#39;s task payload or running the task again with the victim&#39;s secrets.</p> <p>Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim&#39;s run friendlyId can replay it into an environment of their choosing, exposing the victim&#39;s task payload or running the task again with the victim&#39;s secrets.</p> https://db.gcve.eu/vuln/ghsa-4ggh-4c33-wrjj