CVEs affecting 1.2
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-82874 | ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db | 9.4 | — | 2026-08-31 | |
| CVE-2022-23067 | ToolJet - Token Leakage via Referer Header | 8.8 | — | 2022-05-18 | |
| CVE-2022-2631 | Improper Access Control in tooljet/tooljet | 8.8 | — | 2022-08-02 | |
| CVE-2026-54344 | ToolJet GitHub Actions comment body shell injection exposes deployment secrets | 8.8 | — | 2026-07-08 | |
| CVE-2022-3019 | Improper Access Control in tooljet/tooljet | 8.8 | — | 2022-08-29 | |
| CVE-2026-82871 | ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes | 8.2 | — | 2026-08-31 | |
| CVE-2026-82869 | ToolJet Database before v3.16.44 Privilege Escalation via join_tables | 8.2 | — | 2026-08-31 | |
| CVE-2022-2037 | Excessive Attack Surface in tooljet/tooljet | 8.0 | — | 2022-06-09 | |
| CVE-2022-3422 | Improper Privilege Management in tooljet/tooljet | 7.5 | — | 2022-10-07 | |
| CVE-2026-82872 | ToolJet before v3.16.208 Cross-Workspace Authorization Bypass | 7.1 | — | 2026-08-31 | |
| CVE-2026-82870 | ToolJet before v3.16.208 Cross-Tenant Database Manipulation | 7.0 | — | 2026-08-31 | |
| CVE-2022-4111 | Improper Validation of Specified Quantity in Input in tooljet/tooljet | 6.5 | — | 2022-11-22 | |
| CVE-2022-23068 | ToolJet - HTML Injection in Invite New User | 5.4 | — | 2022-05-18 | |
| CVE-2026-82873 | ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export | 5.3 | — | 2026-08-31 | |
| CVE-2026-70642 | ToolJet < 3.21.94 Authorization Bypass via app-environments/init | 5.3 | — | 2026-11-13 | |
| CVE-2026-82875 | ToolJet before v3.16.208 Authorization Bypass via organizationId | 5.1 | — | 2026-08-31 | |
| CVE-2022-3348 | Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet | 4.9 | — | 2022-09-28 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).