appsmithorg appsmith vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20268

Newest CVEs

• CVE-2026-49979

  Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

  appsmithorg · appsmith

  Medium5.1
• CVE-2026-55454

  Appsmith: Caddy admin API exposed without authentication

  appsmithorg · appsmith

  Critical9.9
• CVE-2026-55455

  Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

  appsmithorg · appsmith

  Medium5.3
• CVE-2026-50189

  Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

  appsmithorg · appsmith

  High8.9
• CVE-2026-5418

  appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery

  appsmithorg · appsmith

  Medium6.9
• CVE-2026-30862

  Critical Stored XSS & Privilege Escalation in Appsmith

  appsmithorg · appsmith

  Critical9.1
• CVE-2026-24042

  Appsmith public apps can execute unpublished actions (viewMode confusion)

  appsmithorg · appsmith

  Critical9.4
• CVE-2026-22794

  Account Takeover Vulnerability in Appsmith

  appsmithorg · appsmith

  Critical9.7
• CVE-2024-55604

  Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

  appsmithorg · appsmith

  Medium4.8