CVE-2026-53676 | High | 7.2 | 2026-06-17 | ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the… |
CVE-2025-34282 | Critical | 9.1 | 2025-10-17 | ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload… |
CVE-2025-34281 | Medium | 5.4 | 2025-10-17 | ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scr… |
CVE-2025-9094 | Medium | 4.3 | 2025-08-17 | A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improp… |
CVE-2024-55466 | Medium | 6.5 | 2025-05-12 | An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to… |
CVE-2024-9358 | Medium | 5.3 | 2024-10-01 | A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-3270 | Low | 3.8 | 2024-04-03 | A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The m… |
CVE-2023-45303 | High | 8.4 | 2023-10-06 | ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.te… |
CVE-2022-45608 | High | 8.8 | 2023-03-01 | An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administr… |
CVE-2023-26462 | High | 8.1 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored… |
CVE-2022-48341 | High | 8.8 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator… |
CVE-2022-40004 | Critical | 9.6 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log. |
CVE-2022-31861 | Medium | 5.4 | 2022-09-13 | Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs. |
CVE-2021-42751 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScr… |
CVE-2021-42750 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScr… |
CVE-2020-27687 | High | 8.8 | 2020-12-18 | ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emai… |