Login Request a demo
TO
Product
ToolJet
by ToolJet · last CVE Oct 28, 2026
23
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Vulnerabilities23In the news0Timeline
Severity mix
Critical 4High 10Medium 9Low 0
Severity
All severities23Critical4High10Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ToolJet to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-54344
8.8
0%
Jul 8
ToolJet GitHub Actions comment body shell injection exposes deployment secrets
Affected: < 3.20.180
CVE-2022-3019
8.8
1%
Aug 29
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an…
Affected: before 1.23.0
CVE-2022-2631
8.8
1%
Aug 2
Improper Access Control in tooljet/tooljet
Affected: before 1.19.0
CVE-2022-23067
8.8
1%
May 18
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover
Affected: 0.5.0 through 1.2.2
CVE-2026-55412
8.3
0%
Jun 25
ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise
Affected: < 3.20.178-lts
CVE-2022-2037
8.0
1%
Jun 9
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0
Affected: before 1.16.0
CVE-2026-82871
7.7
0%
Aug 31
ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
Affected: before 3.16.208
CVE-2026-82869
7.7
0%
Aug 31
ToolJet Database before v3.16.44 Privilege Escalation via join_tables
Affected: before 3.16.44
CVE-2022-27978
7.5
1%
Apr 26
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request
Affected: 1.6
CVE-2022-3422
7.5
1%
Oct 7
Improper Privilege Management in tooljet/tooljet
Affected: before 1.26.1
Showing 10