CVE-2026-82875 | Medium | 5.5 | 2026-08-31 | ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without veri… |
CVE-2026-82874 | Critical | 9.9 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db end… |
CVE-2026-82873 | Medium | 5.0 | 2026-08-31 | ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to d… |
CVE-2026-82872 | Critical | 9.1 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operation… |
CVE-2026-82871 | High | 7.7 | 2026-08-31 | ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' tabl… |
CVE-2026-82870 | Critical | 9.6 | 2026-08-31 | ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or d… |
CVE-2026-82869 | High | 7.7 | 2026-08-31 | ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authe… |
CVE-2026-73068 | Medium | 5.9 | 2026-08-11 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet… |
CVE-2026-54344 | Medium | 4.7 | 2026-07-08 | ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.ev… |
CVE-2026-55413 | | | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any auth… |
CVE-2026-55412 | High | 8.3 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's… |
CVE-2026-55411 | Medium | 6.8 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the aut… |
CVE-2022-27979 | Medium | 5.4 | 2023-04-26 | A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2022-27978 | High | 7.5 | 2023-04-26 | Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request. |
CVE-2022-4111 | Medium | 6.5 | 2022-11-22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
|
CVE-2022-3422 | High | 7.5 | 2022-10-07 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_passw… |
CVE-2022-3348 | Medium | 4.9 | 2022-09-28 | Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is need… |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-2037 | High | 8.0 | 2022-06-09 | Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. |
CVE-2022-23068 | Medium | 5.4 | 2022-05-18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while… |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |