Appsmith vulnerabilities

Products

• Appsmith 18

Newest

• appsmith Appsmith: Caddy admin API exposed without authentication CVE-2026-55454 Fix available 9.9 CriticalJune 24, 2026
• appsmith Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist CVE-2026-55455 Fix available 5.3 MediumJune 24, 2026
• appsmith Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route CVE-2026-50189 Fix available 8.9 HighJune 24, 2026
• appsmith Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter CVE-2026-49979 Fix available 5.1 MediumJune 2, 2026
• appsmith CVE-2026-7299 CVE-2026-7299 Public exploitFix available 6.3 MediumJune 2, 2026
• appsmith Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs CVE-2026-34411 Fix available 6.9 MediumMarch 27, 2026
• appsmith Critical Stored XSS & Privilege Escalation in Appsmith CVE-2026-30862 Public exploitFix available 9.1 CriticalMarch 9, 2026
• appsmith Appsmith public apps can execute unpublished actions (viewMode confusion) CVE-2026-24042 Fix available 9.4 CriticalJanuary 22, 2026
• appsmith Account Takeover Vulnerability in Appsmith CVE-2026-22794 Public exploitFix available 9.7 CriticalJanuary 12, 2026
• appsmith An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacke… CVE-2024-55964 Public exploitFix available 9.8 CriticalMarch 26, 2025
• appsmith An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Apps… CVE-2024-55963 Public exploitFix available EPSS 32.9% 6.5 MediumMarch 26, 2025
• appsmith An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have... CVE-2024-55965 Fix available 6.5 MediumMarch 25, 2025
• appsmith Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources CVE-2024-55604 Fix available 4.8 MediumMarch 25, 2025
• appsmith AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests... CVE-2024-51408 Fix available 8.5 HighNovember 4, 2024
• appsmith, appsmithorg appsmithorg/appsmith +1 more Server-Side Request Forgery (SSRF) in appsmithorg/appsmith CVE-2022-4096 Public exploitFix available 8.8 HighNovember 21, 2022
• appsmith An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed... CVE-2022-38299 Fix available 4.3 MediumSeptember 12, 2022
• appsmith Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side... CVE-2022-38298 Fix available 8.8 HighSeptember 12, 2022
• appsmith Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute... CVE-2022-39824 Fix available 8.9 HighSeptember 5, 2022