TO
Product
ToolJet
23
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 4High 10Medium 9Low 0
Watch
Add ToolJet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55411 | 6.8 | Jun 25 | ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets Affected: < 3.20.1780-lts |
| CVE-2026-118685 New | 6.5 | Oct 28 | ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard Affected: 3.20.2-lts before 3.20.242-lts |
| CVE-2022-4111 | 6.5 | Nov 22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB Affected: before 1.27.0 |
| CVE-2026-73068 | 5.9 | Aug 11 | ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables Affected: 3.20.207-lts |
| CVE-2026-82875 | 5.5 | Aug 31 | ToolJet before v3.16.208 Authorization Bypass via organizationId Affected: before 3.16.208 |
| CVE-2022-27979 | 5.4 | Apr 26 | A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body… Affected: 1.6.0 |
| CVE-2022-23068 | 5.4 | May 18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user… Affected: 0.6.0 through 1.10.2 |
| CVE-2026-82873 | 5.0 | Aug 31 | ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export Affected: through 3.0.0-ee-beta.2 |
| CVE-2022-3348 | 4.9 | Sep 28 | Just like in the previous report, an attacker could steal the account of different users Affected: before 2022-09-11 |
Showing 9