CVE-2025-31963
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local atta
CVSS
2.9
Bajo
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 7 ene 2026 · Última mod.: 7 oct 2026 · CWE-306 · CWE-352
0.1%EPSS · 30 días0.1%
2026-09-232026-10-21
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1141089.8 CRÍ28.1%
——8HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.1dCVE-2026-1140934.3 MED3.7%
——1Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.1dCVE-2026-1140926.5 MED36.8%
——11Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.1dCVE-2026-1140907.1 ALT9.9%
——3Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.1dCVE-2026-1140898.8 ALT3.6%
——1Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.1dCVE-2026-1140865.3 MED18.8%
——6Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.1d