CVE-2026-73068 | Medium | 5.9 | 2026-08-11 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet… |
CVE-2026-54344 | Medium | 4.7 | 2026-07-08 | ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.ev… |
CVE-2026-55413 | | | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any auth… |
CVE-2026-55412 | High | 8.3 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's… |
CVE-2026-55411 | Medium | 6.8 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the aut… |
CVE-2022-27979 | Medium | 5.4 | 2023-04-26 | A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2022-27978 | High | 7.5 | 2023-04-26 | Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request. |
CVE-2022-4111 | Medium | 6.5 | 2022-11-22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
|
CVE-2022-3422 | High | 7.5 | 2022-10-07 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_passw… |
CVE-2022-3348 | Medium | 4.9 | 2022-09-28 | Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is need… |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-2037 | High | 8.0 | 2022-06-09 | Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. |
CVE-2022-23068 | Medium | 5.4 | 2022-05-18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while… |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |