Appsmithorg vulnerabilities

Products

• Appsmith 11

Newest

• appsmith Appsmith: Caddy admin API exposed without authentication CVE-2026-55454 Fix available 9.9 CriticalJune 24, 2026
• appsmith Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist CVE-2026-55455 Fix available 5.3 MediumJune 24, 2026
• appsmith Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route CVE-2026-50189 Fix available 8.9 HighJune 24, 2026
• appsmith Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter CVE-2026-49979 Fix available 5.1 MediumJune 2, 2026
• appsmith CVE-2026-7299 CVE-2026-7299 Public exploitFix available 6.3 MediumJune 2, 2026
• appsmithorg appsmith appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery CVE-2026-5418 6.9 MediumApril 2, 2026
• appsmith Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs CVE-2026-34411 Fix available 6.9 MediumMarch 27, 2026
• appsmith Critical Stored XSS & Privilege Escalation in Appsmith CVE-2026-30862 Public exploitFix available 9.1 CriticalMarch 9, 2026
• appsmith Appsmith public apps can execute unpublished actions (viewMode confusion) CVE-2026-24042 Fix available 9.4 CriticalJanuary 22, 2026
• appsmith Account Takeover Vulnerability in Appsmith CVE-2026-22794 Public exploitFix available 9.7 CriticalJanuary 12, 2026
• appsmith Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources CVE-2024-55604 Fix available 4.8 MediumMarch 25, 2025
• appsmith, appsmithorg appsmithorg/appsmith +1 more Server-Side Request Forgery (SSRF) in appsmithorg/appsmith CVE-2022-4096 Public exploitFix available 8.8 HighNovember 21, 2022