DumbAssets vulnerabilities
CVEs whose affected-version data names the DumbAssets package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-45231Medium· 6.1DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields
DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML…
▾ SunlitDumbWareio · DumbAssetsEPSS 0.19%via CVEORG
CVE-2026-45230Critical· 9.1DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that by…
▾ MidnightDumbWareio · DumbAssetsEPSS 0.63%via CVEORG