585 matches found
CVE-2026-53676: Improperly Controlled Modification of Object Prototype Attributes
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...
ThingsBoard vulnerable to prototype pollution
Overview ThingsBoard contains the following vulnerability Prototype Pollution CWE-1321 - CVE-2026-53676 HIROKI IMAI of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary code may be...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537: Authentication Bypass by Spoofing
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
PT-2026-49287
Name of the Vulnerable Software and Affected Versions ThingsBoard version 4.3.0.1 Description An authentication bypass exists during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the '/login/oauth2/code/' endpoint...
GHSA-5M62-PW8W-7W9F vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-43515 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-FV25-8XCX-GQJC vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-GX5V-XP9W-J4CG vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-42498 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-43513 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-5MP6-JRQ3-R938 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-41284 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-41293 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-43512 vulnerabilities
Vulnerabilities for packages: thingsboard...