Ramas de versiones afectadas
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-70642 | ToolJet < 3.21.94 Authorization Bypass via app-environments/init | < 3.21.94 | 5.3 | — | 2026-11-13 | |
| CVE-2026-118685 | ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard | ≥ 3.20.2-lts < 3.20.242-lts | 6.9 | — | 2026-10-29 | |
| CVE-2026-82875 | ToolJet before v3.16.208 Authorization Bypass via organizationId | < 3.16.208 | 5.1 | — | 2026-08-31 | |
| CVE-2026-82874 | ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db | < 3.16.208 | 9.4 | — | 2026-08-31 | |
| CVE-2026-82873 | ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export | ≤ 3.0.0-ee-beta.2 | 5.3 | — | 2026-08-31 | |
| CVE-2026-82871 | ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes | < 3.16.208 | 8.2 | — | 2026-08-31 | |
| CVE-2026-82872 | ToolJet before v3.16.208 Cross-Workspace Authorization Bypass | < 3.16.208 | 7.1 | — | 2026-08-31 | |
| CVE-2026-82870 | ToolJet before v3.16.208 Cross-Tenant Database Manipulation | < 3.16.208 | 7.0 | — | 2026-08-31 | |
| CVE-2026-82869 | ToolJet Database before v3.16.44 Privilege Escalation via join_tables | < 3.16.44 | 8.2 | — | 2026-08-31 | |
| CVE-2026-73068 | ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read... | = 3.20.207-lts | 5.9 | — | 2026-08-12 | |
| CVE-2026-54344 | ToolJet GitHub Actions comment body shell injection exposes deployment secrets | * < 3.20.180 | 8.8 | — | 2026-07-08 | |
| CVE-2026-55411 | ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user... | * | 6.8 | — | 2026-06-26 | |
| CVE-2026-55412 | ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise | * | 8.3 | — | 2026-06-26 | |
| CVE-2026-55413 | ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution | * | 9.4 | — | 2026-06-26 | |
| CVE-2022-27978 | Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passw... | = 1.6 | 7.5 | — | 2023-04-26 | |
| CVE-2022-27979 | A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts... | = 1.6.0 | 5.4 | — | 2023-04-26 | |
| CVE-2022-4111 | Improper Validation of Specified Quantity in Input in tooljet/tooljet | * < 1.27.0 | 6.5 | — | 2022-11-22 | |
| CVE-2022-3422 | Improper Privilege Management in tooljet/tooljet | * < 1.26.1 | 7.5 | — | 2022-10-07 | |
| CVE-2022-3348 | Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet | * < 2022-09-11 | 4.9 | — | 2022-09-28 | |
| CVE-2022-3019 | Improper Access Control in tooljet/tooljet | * < 1.23.0 | 8.8 | — | 2022-08-29 | |
| CVE-2022-2631 | Improper Access Control in tooljet/tooljet | * < 1.19.0 | 8.8 | — | 2022-08-02 | |
| CVE-2022-2037 | Excessive Attack Surface in tooljet/tooljet | * < 1.16.0 | 8.0 | — | 2022-06-09 | |
| CVE-2022-23067 | ToolJet - Token Leakage via Referer Header | ≥ 0.5.0 < unspecified ≥ unspecified ≤ 1.2.2 ≥ 0.5.0 ≤ 1.2.2 | 8.8 | — | 2022-05-18 | |
| CVE-2022-23068 | ToolJet - HTML Injection in Invite New User | ≥ 0.6.0 < unspecified ≥ unspecified ≤ 1.10.2 ≥ 0.6.0 ≤ 1.10.2 | 5.4 | — | 2022-05-18 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).