CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

373 matches found

CVE-2026-53676

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...

8.6CVSS0.00603EPSS

Exploits0References3

CVE•added last week•16 views

CVE-2026-53676

Technical details for CVE-2026-53676 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

8.6CVSS7.8AI score0.00603EPSS

Exploits0References3

Positive Technologies•added 2026/06/17 12:0 a.m.•12 views

PT-2026-50571

Name of the Vulnerable Software and Affected Versions ThingsBoard affected versions not specified Description Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially leading to arbitrary code execution within a sandboxed context. This issue can be...

8.6CVSS7.6AI score0.00603EPSS

Exploits0References5

NVD•added 2026/06/15 8:16 p.m.•7 views

CVE-2026-36537

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

9.8CVSS0.00511EPSS

Exploits0References1

Cvelist•added 2026/06/15 12:0 a.m.•29 views

CVE-2026-36537

0.00511EPSS

Exploits0References1

Positive Technologies•added 2026/06/15 12:0 a.m.•7 views

PT-2026-49287

Name of the Vulnerable Software and Affected Versions ThingsBoard version 4.3.0.1 Description An authentication bypass exists during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the '/login/oauth2/code/' endpoint...

9.8CVSS5.4AI score0.00511EPSS

Exploits0References3

CVE•added 2026/06/15 12:0 a.m.•12 views

CVE-2026-36537

ThingsBoard 4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The vulnerability arises because the application trusts user-supplied identity data in the user parameter of the /login/oauth2/code/ endpoint; by manipulating the email field in that JSON, ...

9.8CVSS5.5AI score0.00511EPSS

Exploits0References1