Retool

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Retool records in CISA KEV

No Retool vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Retool 1 record LOW

Records

3 records

TI-2025-29932 CVE-2025-47424 · GHSA-xw45-9vvw-6qg3

Retool (self-hosted) before 3.196.0 allows Host header injection.

LOW 32

Retool (self-hosted) before 3.196.0 allows Host header injection.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00158 Published 2025-05-09 No fix listed CWE-348

TI-2024-39149 CVE-2024-58394 · GHSA-h68x-76fm-hh89

Cross-site scripting in Retool image proxy lets attackers run scripts

LOW 29

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00204 Published 2026-10-22 Fixed in 3.88.0 CWE-79

TI-2024-28062 CVE-2024-42056 · GHSA-f3c7-2m22-wr7x

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication…

LOW 28

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0021 Published 2024-08-22 No fix listed CWE-352

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0