ToolJet ToolJet

• CVE-2026-118685 Medium 6.5 ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard 0.2%
• CVE-2026-82875 Medium 5.5 ToolJet before v3.16.208 Authorization Bypass via organizationId 0.2%
• CVE-2026-82874 Critical 9.9 ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db 0.4%
• CVE-2026-82873 Medium 5.0 ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export 0.3%
• CVE-2026-82872 Critical 9.1 ToolJet before v3.16.208 Cross-Workspace Authorization Bypass 0.5%
• CVE-2026-82871 High 7.7 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes 0.4%
• CVE-2026-82870 Critical 9.6 ToolJet before v3.16.208 Cross-Tenant Database Manipulation 0.4%
• CVE-2026-82869 High 7.7 ToolJet Database before v3.16.44 Privilege Escalation via join_tables 0.4%
• CVE-2026-73068 Medium 5.9 ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables 0.3%
• CVE-2026-54344 Medium 4.7 ToolJet GitHub Actions comment body shell injection exposes deployment secrets 0.4%
• CVE-2026-55411 Medium 6.8 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets 0.2%
• CVE-2026-55412 High 8.3 ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise 0.3%
• CVE-2026-55413 Critical 9.4 ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution 0.3%
• CVE-2022-23068 Medium 5.4 ToolJet - HTML Injection in Invite New User 0.6%
• CVE-2022-23067 High 8.8 ToolJet - Token Leakage via Referer Header 1.3%