Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
npm @trigger.dev/core · Upgrade to 4.5.6 or later · >= 3.3.8, <= 4.5.5 · CVE-2026-73654 · GHSA-p28v-f755-9qrg
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @trigger.dev/core · Upgrade to 4.5.6 or later · >= 3.3.8, <= 4.5.5 · CVE-2026-73654 · GHSA-p28v-f755-9qrg
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-rm43-82j9-r4mj
Packagist pimcore/pimcore · Upgrade to 2026.1.5 or 12.3.9 by release line · >= 2026.1.0, <= 2026.1.4; < 12.3.9 · CVE-2026-55072 · GHSA-2mhj-fhvg-v428 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.