PA
Product
Part-DB-server
10
CVEs
0
On KEV
9.6
Max CVSS
9
New 30D
Severity mix
Critical 1High 1Medium 8Low 0
Watch
Add Part-DB-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54631 New | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie Affected: < 2.12.1 |
| CVE-2026-54615 New | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) Affected: < 2.12.1 |
| CVE-2026-55600 New | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name Affected: < 2.12.2 |
| CVE-2025-55194 | 5.7 | Aug 13 | Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload Affected: < 1.17.3 |
| CVE-2026-59188 New | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer Affected: < 2.12.3 |
| CVE-2026-86019 New | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload Affected: < 2.13.2 |
| CVE-2026-86018 New | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads Affected: < 2.13.2 |
| CVE-2026-86020 New | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports Affected: < 2.13.2 |
Showing 8