Log in Start free

ToolJet

Products

ProductCVEsExploitedLatest
ToolJet15–Oct 28, 2026
tooljet/tooljet6–Nov 22, 2022

Exploited and recent CVEs

  • CVE-2026-118685 Medium 6.5 ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard 0.2%
  • CVE-2026-82875 Medium 5.5 ToolJet before v3.16.208 Authorization Bypass via organizationId 0.2%
  • CVE-2026-82874 Critical 9.9 ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db 0.4%
  • CVE-2026-82873 Medium 5.0 ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export 0.3%
  • CVE-2026-82872 Critical 9.1 ToolJet before v3.16.208 Cross-Workspace Authorization Bypass 0.5%
  • CVE-2026-82871 High 7.7 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes 0.4%
  • CVE-2026-82870 Critical 9.6 ToolJet before v3.16.208 Cross-Tenant Database Manipulation 0.4%
  • CVE-2026-82869 High 7.7 ToolJet Database before v3.16.44 Privilege Escalation via join_tables 0.4%
  • CVE-2026-73068 Medium 5.9 ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables 0.3%
  • CVE-2026-54344 Medium 4.7 ToolJet GitHub Actions comment body shell injection exposes deployment secrets 0.4%
  • CVE-2026-55411 Medium 6.8 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets 0.2%
  • CVE-2026-55412 High 8.3 ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise 0.3%
  • CVE-2026-55413 Critical 9.4 ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution 0.3%
  • CVE-2022-4111 Medium 6.5 Improper Validation of Specified Quantity in Input in tooljet/tooljet 0.8%
  • CVE-2022-3422 Critical 9.8 Improper Privilege Management in tooljet/tooljet 1.0%
  • CVE-2022-3348 Medium 6.5 Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet 1.1%
  • CVE-2022-3019 High 7.1 Improper Access Control in tooljet/tooljet 1.0%
  • CVE-2022-2631 Critical 9.8 Improper Access Control in tooljet/tooljet 1.2%
  • CVE-2022-2037 Critical 9.8 Excessive Attack Surface in tooljet/tooljet 1.2%
  • CVE-2022-23068 Medium 5.4 ToolJet - HTML Injection in Invite New User 0.6%
  • CVE-2022-23067 High 8.8 ToolJet - Token Leakage via Referer Header 1.3%