CVE-2026-24308 vulnerabilities

Vulnerabilities for packages: thingsboard, spark, trino, solr, apache-pulsar, zookeeper, kserve-modelmesh, apache-nifi, strimzi-kafka-operator, apache-activemq-artemis, druid, akhq, tez...

CLEANSTART-2026-SP64433 Security fixes for GHSA-6RW7-VPXM-498P, GHSA-73RR-HH4G-FPGX, GHSA-8QQ5-RM4J-MR97 applied in versions: 4.2.1.1-r1

Multiple security vulnerabilities affect the thingsboard package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-23667

Multiple security vulnerabilities affect the thingsboard package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FPJ8-GQ4V-P354 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2026-24733 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-QQ5R-98HH-RXC9 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-66614 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-FPJ8-GQ4V-P354 vulnerabilities

Vulnerabilities for packages: kayenta, kayenta-fips, thingsboard, nacos, ontop-fips, ontop, nacos-docker...

CVE-2026-24733 vulnerabilities

Vulnerabilities for packages: kayenta, kayenta-fips, thingsboard, nacos, ontop-fips, ontop, nacos-docker...

GHSA-QQ5R-98HH-RXC9 vulnerabilities

Vulnerabilities for packages: kayenta, kayenta-fips, thingsboard, nacos, ontop-fips, ontop, nacos-docker...

CVE-2025-66614 vulnerabilities

Vulnerabilities for packages: kayenta, kayenta-fips, thingsboard, nacos, ontop-fips, ontop, nacos-docker...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2024-34750 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-WM9W-RJJ3-J356 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: thingsboard, json-server, tileserver-gl, sqlpad, saf...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: thingsboard, json-server, tileserver-gl, sqlpad, saf...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: thingsboard, redisinsight, argo-workflows, librechat, tileserver-gl, json-server, sqlpad, saf...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: thingsboard, redisinsight, argo-workflows, librechat, tileserver-gl, json-server, sqlpad, saf...

CVE-2025-3261

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...