CVE-2025-34282: Server-Side Request Forgery (SSRF)

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

PT-2025-42641

Name of the Vulnerable Software and Affected Versions ThingsBoard versions prior to 4.2.1 Description The software contains a stored cross-site scripting XSS issue within the dashboard's Image Upload Gallery feature. An attacker can upload a Scalable Vector Graphics SVG file containing malicious...

ThingsBoard 安全漏洞

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard versions prior to 4.2.1, which stems from insufficient cleanup of uploaded SVG files and improper validation of content type...

EUVD-2024-49883

Malicious code in bioql PyPI...

EUVD-2022-51041

Malicious code in bioql PyPI...

EUVD-2024-31861

Malicious code in bioql PyPI...

EUVD-2021-29709

Malicious code in bioql PyPI...

EUVD-2021-29708

Malicious code in bioql PyPI...

EUVD-2023-2677

Malicious code in bioql PyPI...

EUVD-2025-25105

Malicious code in bioql PyPI...

EUVD-2022-53208

Malicious code in bioql PyPI...

EUVD-2025-14279

Malicious code in bioql PyPI...

EUVD-2022-48472

Malicious code in bioql PyPI...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-nifi, wildfly, sonarqube, docker-selenium, kserve-modelmesh, strimzi-kafka-operator, selenium, druid, akhq, flyway, apache-activemq-artemis, celeborn, trino, tez, thingsboard, wavefront-proxy, opensearch, zipkin...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-nifi, wildfly, sonarqube, docker-selenium, kserve-modelmesh, strimzi-kafka-operator, selenium, druid, akhq, flyway, apache-activemq-artemis, celeborn, trino, tez, thingsboard, wavefront-proxy, opensearch, zipkin...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: keycloak, wildfly, celeborn, logstash, druid, docker-selenium, tez, flyway, keycloak-fips, opensearch, strimzi-kafka-operator, trino, wavefront-proxy, kserve-modelmesh, localstack, sonarqube, elasticsearch-fips, thingsboard, seata, zipkin, neo4j, kayenta,...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: keycloak, wildfly, celeborn, logstash, druid, docker-selenium, tez, flyway, keycloak-fips, opensearch, strimzi-kafka-operator, trino, wavefront-proxy, kserve-modelmesh, localstack, sonarqube, elasticsearch-fips, thingsboard, seata, zipkin, neo4j, kayenta,...

GHSA-3P8M-J85Q-PGMJ vulnerabilities

Vulnerabilities for packages: cassandra-reaper, keycloak, wildfly, cloudwatch-exporter, cassandra, celeborn, logstash, druid, docker-selenium, tez, flyway, kafka, keycloak-fips, opensearch, strimzi-kafka-operator, trino, wavefront-proxy, kserve-modelmesh, localstack, sonarqube, elasticsearch-fips...

CVE-2025-9094

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2025-9094

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...