Skip to content

Product

Adalo No-Code App Builder App Builder vulnerabilities

2 published CVES affecting Adalo No-Code App Builder App Builder, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest Adalo No-Code App Builder App Builder CVEs

Newest publication first

  1. CVE-2026-10706 Exposure of Sensitive Information to an Unauthorized attacker

    Published
    HighCVSS 7.5 EPSS 0.42%

    In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical s...

  2. CVE-2026-10708 Insufficiently Protected Credentials

    Published
    HighCVSS 7.5 EPSS 0.21%

    This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.