CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: langfuse, thingsboard-fips, kibana, jitsucom-jitsu, langfuse-fips, tileserver-gl-fips, tileserver-gl...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: seata, apache-hop-fips, apache-hop, tez, thingsboard, management-api-for-apache-cassandra-5.0...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, tez...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, management-api-for-apache-cassandra-5.0, apache-nifi, opensearch, spark, tez, thingsboard, apache-pulsar, akhq, druid, zipkin, apicurio-registry...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: nrjmx, thingsboard, cassandra-reaper, akhq, druid, apicurio-registry...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: nrjmx, thingsboard, cassandra-reaper, akhq, druid, apicurio-registry...

CLEANSTART-2026-GY63167 Security fixes in thingsboard 4.3.1.3-r1

Package thingsboard version 4.3.1.3-r1 fixes 82 vulnerabilities: ghsa-r29c-68gh-xp6x, ghsa-h6fc-48rj-7qqh, ghsa-5m62-pw8w-7w9f, ghsa-gx5v-xp9w-j4cg, ghsa-fv25-8xcx-gqjc...

CLEANSTART-2026-DE16547 Security fixes in thingsboard 4.3.1.3-r2

Package thingsboard version 4.3.1.3-r2 fixes 4 vulnerabilities: ghsa-j92g-9f8w-j867, CVE-2026-54291, ghsa-v422-hmwv-36x6, CVE-2026-12590...

CLEANSTART-2026-SE70344 Security fixes in thingsboard 4.2.2.3-r1

Package thingsboard version 4.2.2.3-r1 fixes 84 vulnerabilities: ghsa-r29c-68gh-xp6x, ghsa-h6fc-48rj-7qqh, ghsa-5m62-pw8w-7w9f, ghsa-gx5v-xp9w-j4cg, ghsa-fv25-8xcx-gqjc...

CLEANSTART-2026-DF65742 Security fixes in thingsboard-tb-web-ui 4.3.1-r0

Package thingsboard-tb-web-ui version 4.3.1-r0 fixes 4 vulnerabilities: CVE-2026-26960, CVE-2026-29786, CVE-2026-31802, CVE-2026-2391...

CLEANSTART-2026-NU98727 Security fixes in thingsboard-tb-web-ui 4.3.1.1-r1

Package thingsboard-tb-web-ui version 4.3.1.1-r1 fixes 10 vulnerabilities: CVE-2026-8723, CVE-2026-53655, CVE-2026-47759, CVE-2026-47761, CVE-2026-47762...

GHSA-V74W-7MR3-4QG3 vulnerabilities

Vulnerabilities for packages: seata, apache-hop-fips, apache-hop, tez, thingsboard, management-api-for-apache-cassandra-5.0...

GHSA-V74W-7MR3-4QG3 vulnerabilities

Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, tez...

GHSA-8R6M-32JQ-JX6Q vulnerabilities

Vulnerabilities for packages: langfuse, thingsboard-fips, kibana, jitsucom-jitsu, langfuse-fips, tileserver-gl-fips, tileserver-gl...

CVE-2026-53676

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...

CVE-2026-53676

Technical details for CVE-2026-53676 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

PT-2026-50571

Name of the Vulnerable Software and Affected Versions ThingsBoard affected versions not specified Description Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially leading to arbitrary code execution within a sandboxed context. This issue can be...

CVE-2026-36537

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

CVE-2026-36537

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

CVE-2026-36537

ThingsBoard 4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The vulnerability arises because the application trusts user-supplied identity data in the user parameter of the /login/oauth2/code/ endpoint; by manipulating the email field in that JSON, ...