{"vulnerability": "CVE-2026-7365", "sightings": [{"uuid": "2a6a5a62-2ff8-4ebc-ab00-6597ead63a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7365", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmtrklzls42s", "content": "\ud83d\udfe0 CVE-2026-7365 - High (8.4)\n\nIBM Operations Analytics - Log Analysis\u00a0 and IBM SmartCloud Analytics - Log Analysis uses defaul...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-7365/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-27T15:01:00.996635Z"}, {"uuid": "fbce5122-4273-4dd5-9679-c2374d31306a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7365", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmtvfujfj62t", "content": "CVE-2026-7365 - IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation\nCVE ID : CVE-2026-7365\n \n Published : May 27, 2026, 2:17 p.m. | 52\u00a0minutes ago\n \n Description : IBM Operat...", "creation_timestamp": "2026-05-27T16:09:56.020956Z"}, {"uuid": "a0b3a2e6-0c85-423b-a79e-542419a5a977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7365", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mndr6yozhh2t", "content": "\ud83d\udccc CVE-2026-7365 - IBM Operations Analytics - Log Analysis\u00a0 and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing p... https://www.cyberhub.blog/cves/CVE-2026-7365", "creation_timestamp": "2026-06-02T23:37:06.339431Z"}, {"uuid": "3d8dd18a-8c86-4e5e-bf45-447f9ac863ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73656", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4r7r4i742c", "content": "CVE-2026-73656\nA bug in Trigger.dev's API allowed an attacker to hijack another project's deployment by linking their worker to it. This could have caused unintended deployments or disruptions. The issue is fixed in version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T13:20:03.375478Z"}, {"uuid": "50c2301d-12b8-4540-99c8-69606ec123ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73653", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyefowhas2p", "content": "CVE-2026-73653 - vitest\nVitest, a testing framework, had a security issue that allowed unauthorized users to read or modify local files. This was fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6. If you're\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vitest #vitestdev #CVE #infosec", "creation_timestamp": "2026-08-13T19:20:04.874871Z"}, {"uuid": "883c5fc1-51db-4b8f-8741-693624f88f63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73650", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msygo65aqv2u", "content": "\ud83d\udfe0 CVE-2026-73650 - High (8.2)\n\nSVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing S...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73650/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T20:00:37.963848Z"}, {"uuid": "3492123b-13bb-445a-bbe0-b6e3d4ad2590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73653", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msygofghlf22", "content": "\ud83d\udd34 CVE-2026-73653 - Critical (9.4)\n\nVitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73653/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T20:00:45.849754Z"}, {"uuid": "71d44ca8-373a-49eb-8a92-3998d97771eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73656", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyictmqt725", "content": "CVE-2026-73656 - trigger.dev\nAn attacker with an API key for one Trigger.dev project can hijack another project's deployment by linking their own worker to it. This can cause the hijacked project to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#triggerdev #triggerdotdev #CVE #infosec", "creation_timestamp": "2026-08-13T20:30:04.495847Z"}, {"uuid": "82e90561-dddd-411d-82a8-5a4787466647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73651", "type": "published-proof-of-concept", "source": "https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49", "content": "", "creation_timestamp": "2026-08-13T20:35:04.925533Z"}, {"uuid": "d1ad64ed-50be-4f13-8897-4dcba653d9b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73650", "type": "published-proof-of-concept", "source": "https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545", "content": "", "creation_timestamp": "2026-08-13T20:35:07.368597Z"}, {"uuid": "089204ed-d870-445f-959b-3084a46d50fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73656", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ddesptxkbkumx", "content": "CVE-2026-73656 - Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state\nCVE ID : CVE-2026-73656\n \n Published : Aug. 13, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : Trigger.dev is a platform for building and deploying fully...", "creation_timestamp": "2026-08-13T21:01:17.694380Z"}, {"uuid": "b0d2846d-1ba3-4cd0-8bbd-077ecd8415fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73655", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ssefvvnc63ge", "content": "CVE-2026-73655 - Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login\nCVE ID : CVE-2026-73655\n \n Published : Aug. 13, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : Trigger.dev is a platform for building and deploying fully managed AI agents...", "creation_timestamp": "2026-08-13T21:07:17.348726Z"}, {"uuid": "70364c99-c99f-4848-9b5c-aba81169135b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73654", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3t5nhhw2d4xyv", "content": "CVE-2026-73654 - Trigger.dev: Prototype pollution via run metadata operations \u2192 process-wide cross-tenant DoS\nCVE ID : CVE-2026-73654\n \n Published : Aug. 13, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : Trigger.dev is a platform for building and deploying fully managed AI...", "creation_timestamp": "2026-08-13T21:09:18.560367Z"}, {"uuid": "9e0b107d-1c60-4b84-a47e-6e2b7e9b2238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73654", "type": "seen", "source": "https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da", "content": "# CVE-2026-73654: CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73654\n\n## Summary\nCVE-2026-73654 is a high-severity prototype pollution vulnerability in Trigger.dev. The flaw occurs during the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata endpoint. Because user-supplied keys are parsed directly by the @jsonhero/path library without sanitization, an authenticated attacker with low privileges can pollute the global Object.prototype. This causes database queries via Prisma ORM to fail validation and induces unhandled exceptions in the Prometheus metrics client, resulting in a process-wide denial of service.\n\n## TL;DR\nUnvalidated JSON path validation in the Trigger.dev metadata update endpoint allows authenticated attackers to pollute Object.prototype, crashing Prisma queries and Prometheus metrics client instances, resulting in a system-wide denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: Low (PR:L)\n- **Scope**: Changed (S:C)\n- **Integrity Impact**: Low (I:L)\n- **Availability Impact**: High (A:H)\n- **CVSS Score**: 8.5\n- **Exploit Status**: PoC (Proof of Concept)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Trigger.dev Self-Hosted Platforms\n- Trigger.dev Cloud Worker Nodes\n- **trigger.dev**: >= 3.3.8, < 4.5.6 (Fixed in: `4.5.6`)\n\n## Mitigation\n\n- Upgrade all Trigger.dev dependencies to version 4.5.6 or higher\n- Deploy WAF content filtering rules to inspect and block prototype manipulation strings in dynamic metadata request paths\n\n**Remediation Steps:**\n1. 1. Update workspace dependencies by executing `pnpm update @trigger.dev/core@4.5.6` or updating the root package.json file.\n2. 2. Redeploy the self-hosted Trigger.dev platform with the patched version to refresh runtime worker nodes.\n3. 3. Configure reverse proxy or WAF layer to identify and drop PUT requests containing prototype traversal segments if instant patching is impossible.\n\n## References\n\n- [GitHub Security Advisory GHSA-p28v-f755-9qrg](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg)\n- [Fix Commit 6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0](https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0)\n- [Pull Request #4316](https://github.com/triggerdotdev/trigger.dev/pull/4316)\n- [Release v4.5.6](https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73654) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T21:32:39.471733Z"}, {"uuid": "8ba4afd6-9ec7-47af-8bcb-c696ad82ec8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73654", "type": "published-proof-of-concept", "source": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg", "content": "", "creation_timestamp": "2026-08-13T22:35:03.634102Z"}, {"uuid": "947d6da1-1fa9-4221-93d8-4703d29dff46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73658", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyu3oovlv2t", "content": "\ud83d\udfe0 CVE-2026-73658 - High (8.2)\n\nTrigger.dev is a platform for building and deploying fully managed AI agents and workflows. From ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73658/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-14T00:00:50.056765Z"}, {"uuid": "765bd4d5-eed7-4096-a97e-610e2d2b7d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73658", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3msywtbyduu2d", "content": "Another Elegant CVE, Another Managed Workflow Headed for the Drain\nPANIC 68% | Lag 0.0h | CVE-2026-73658 is a high-severity vulnerability affecting Trigger.dev, a platform used to build and \n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-14T00:49:48.340002Z"}, {"uuid": "6fc3b22c-db56-4553-9f52-8659b00c17e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73659", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyxgvdtzr27", "content": "\ud83d\udfe0 CVE-2026-73659 - High (8.1)\n\nTrigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73659/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-14T01:00:47.955426Z"}]}