Thingsboard vulnerabilities

Products

• Thingsboard 17

Newest

• thingsboard ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code... CVE-2026-53676 8.6 HighJune 17, 2026
• thingsboard ThingsBoard YAML provision getGatewayDockerComposeFile code injection CVE-2026-9568 2.3 LowMay 26, 2026
• thingsboard ThingsBoard < v4.2.1 SVG Image SSRF CVE-2025-34282 Public exploit 6.9 MediumOctober 17, 2025
• thingsboard Stored Cross-Site Scripting (XSS) in ThingsBoard CVE-2025-34281 Fix available 6.2 MediumOctober 17, 2025
• thingsboard ThingsBoard Add Gateway special elements used in a template engine CVE-2025-9094 5.3 MediumAugust 17, 2025
• thingsboard An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard... CVE-2024-55466 Public exploit 6.5 MediumMay 12, 2025
• thingsboard ThingsBoard HTTP RPC API resource consumption CVE-2024-9358 6.0 MediumOctober 1, 2024
• thingsboard ThingsBoard AdvancedFeature access control CVE-2024-3270 3.8 LowApril 3, 2024
• thingsboard ThingsBoard Server-Side Template Injection CVE-2023-45303 Fix available 8.4 HighOctober 6, 2023
• thingsboard An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to... CVE-2022-45608 8.8 HighMarch 1, 2023
• thingsboard ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded... CVE-2023-26462 8.1 HighFebruary 23, 2023
• thingsboard ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege... CVE-2022-48341 8.8 HighFebruary 23, 2023
• thingsboard Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to... CVE-2022-40004 9.6 CriticalDecember 15, 2022
• thingsboard Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being... CVE-2022-31861 5.4 MediumSeptember 13, 2022
• thingsboard A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote... CVE-2021-42751 Public exploit 4.8 MediumAugust 12, 2022
• thingsboard A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote... CVE-2021-42750 Public exploit 4.8 MediumAugust 12, 2022
• thingsboard ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This... CVE-2020-27687 8.8 HighDecember 18, 2020