Retool
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Retool | 2 | – | Oct 22, 2026 |
Exploited and recent CVEs
- CVE-2024-58394 Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying 0.2%
- CVE-2025-47424 Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated. 0.2%