ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)

Exploit Title: ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery SSRF Date: 2026-03-25 Exploit Author: Tamil Mathi T. Vendor Homepage: https://thingsboard.io Software Link: https://github.com/thingsboard/thingsboard Version: . When ThingsBoard processes the uploaded SVG server-side, it...

CLEANSTART-2026-IS05941 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native

Multiple security vulnerabilities affect the thingsboard package. CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. See references for individual vulnerability details...

GHSA-H468-7PVH-8VR8 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2026-29146 vulnerabilities

Vulnerabilities for packages: thingsboard...

CLEANSTART-2026-CK64127 Security fixes for ghsa-6rw7-vpxm-498p, ghsa-73rr-hh4g-fpgx, ghsa-8qq5-rm4j-mr97, ghsa-wqch-xfxh-vrr4 applied in versions: 4.2.1.1-r1

Multiple security vulnerabilities affect the thingsboard package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DU32240 Security fixes for CVE-2026-2391, CVE-2026-26960, CVE-2026-29786, CVE-2026-31802, ghsa-34x7-hfp2-rc4v, ghsa-5359-pvf2-pw78, ghsa-73rr-hh4g-fpgx, ghsa-8qq5-rm4j-mr97, ghsa-r6q2-hw4h-h46w applied in versions: 4.2.1.1-r1, 4.2.1.1-r2, 4.3.0.1-r0, 4.3.1-r0

Multiple security vulnerabilities affect the thingsboard-tb-web-ui package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JK47870 Security fixes for CVE-2025-66614, CVE-2026-1225, CVE-2026-24281, CVE-2026-24308, CVE-2026-24733, ghsa-6rw7-vpxm-498p, ghsa-73rr-hh4g-fpgx, ghsa-8qq5-rm4j-mr97, ghsa-wqch-xfxh-vrr4 applied in versions: 4.2.1.1-r1, 4.3.1-r0

Multiple security vulnerabilities affect the thingsboard package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-6HCQ-HMM3-JJ3C vulnerabilities

Vulnerabilities for packages: thingsboard, apache-nifi-registry...

CVE-2026-4923 vulnerabilities

Vulnerabilities for packages: thingsboard, saf, vitess, langfuse, tileserver-gl, code-server...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: thingsboard, saf, vitess, langfuse, tileserver-gl, code-server...

GHSA-J3Q9-MXJG-W52F vulnerabilities

Vulnerabilities for packages: thingsboard, saf, vitess, langfuse, tileserver-gl, code-server...

GHSA-4773-3JFM-QMX3 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-nifi-registry...

CVE-2026-22735 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-nifi-registry...

CVE-2026-22737 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-nifi-registry...

GHSA-27V5-C462-WPQ7 vulnerabilities

Vulnerabilities for packages: thingsboard, saf, vitess, langfuse, tileserver-gl, code-server...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: infinispan, spark, apache-pulsar, trino, management-api-for-apache-cassandra-5.0, thingsboard, celeborn, akhq, sonarqube, kserve-modelmesh, apicurio-registry, druid, strimzi-kafka-operator, wildfly, wavefront-proxy, keycloak, opensearch, neo4j, zipkin, flyway...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: infinispan, spark, apache-pulsar, trino, management-api-for-apache-cassandra-5.0, thingsboard, celeborn, akhq, sonarqube, kserve-modelmesh, apicurio-registry, druid, strimzi-kafka-operator, wildfly, wavefront-proxy, keycloak, opensearch, neo4j, zipkin, flyway...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: camunda-zeebe, management-api-for-apache-cassandra-5.0, akhq, spark, apache-camel-karavan-devmode, tinkerpop, wavefront-proxy, keycloak, localstack, sonarqube, druid, grpc-java-fips, keycloak-fips, neo4j, seata, wildfly, elasticsearch-fips, apache-pulsar, flyway,...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, management-api-for-apache-cassandra-5.0, akhq, spark, apache-camel-karavan-devmode, tinkerpop, wavefront-proxy, keycloak, localstack, sonarqube, druid, grpc-java-fips, keycloak-fips, neo4j, seata, wildfly, elasticsearch-fips, apache-pulsar, flyway,...

GHSA-PWQR-WMGM-9RR8 vulnerabilities

Vulnerabilities for packages: infinispan, spark, apache-pulsar, trino, management-api-for-apache-cassandra-5.0, tez, logstash, thingsboard, apache-activemq-artemis, celeborn, akhq, sonarqube, kserve-modelmesh, apicurio-registry, druid, strimzi-kafka-operator, wavefront-proxy, wildfly, keycloak,...