Part-DB has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 5.7 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Weakness classes
Products
- Part-DB-server 9
Worst active — by depth score
CVE-2026-54630Critical· 9.6Part-DB: Authenticated RCE via .phar attachment upload served from public/media53CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover48CVE-2026-54631Medium· 6.3Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie35CVE-2026-54615Medium· 6.0Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)33CVE-2026-55600Medium· 5.7Part-DB: Stored HTML injection in BOM validation results via unescaped Part name31
Part-DB vulnerabilities
CVEs affecting Part-DB, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-86019Medium· 5.3Part-DB: Attachment Size Limit Bypass via API Base64 Upload
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the A…
CVE-2026-86018Medium· 5.3Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download exter…
CVE-2026-59188Medium· 5.4Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An …
CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no t…
CVE-2026-86020Medium· 4.6Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permi…
CVE-2026-54630Critical· 9.6Part-DB: Authenticated RCE via .phar attachment upload served from public/media
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extens…
CVE-2026-54615Medium· 6.0Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. …
CVE-2026-54631Medium· 6.3Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The off…
CVE-2026-55600Medium· 5.7Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders popula…