AP
Product
appsmith
19
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 5High 5Medium 8Low 1
Watch
Add appsmith to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55454 | 9.9 | Jun 24 | Appsmith: Caddy admin API exposed without authentication Affected: before 2.1 |
| CVE-2026-24042 | 9.8 | Jan 22 | Appsmith public apps can execute unpublished actions (viewMode confusion) Affected: through 1.94 |
| CVE-2024-55964 | 9.8 | Mar 26 | An issue was discovered in Appsmith before 1.52 Affected: before 1.52 |
| CVE-2026-55455 | 9.1 | Jun 24 | Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist Affected: before 2.1 |
| CVE-2026-30862 | 9.0 | Mar 9 | Critical Stored XSS & Privilege Escalation in Appsmith Affected: before 1.96 |
| CVE-2022-39824 | 8.9 | Sep 5 | Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list… Affected: through 1.7.14 |
| CVE-2026-22794 | 8.8 | Jan 12 | Account Takeover Vulnerability in Appsmith Affected: before 1.93 |
| CVE-2022-38298 | 8.8 | Sep 12 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata… Affected: 1.7.11 |
| CVE-2026-5418 | 7.3 | Apr 2 | appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
| CVE-2026-50189 | 7.2 | Jun 24 | Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route Affected: before 2.1 |
| CVE-2024-55963 | 6.5 | Mar 26 | An issue was discovered in Appsmith before 1.51 Affected: before 1.51 |
| CVE-2024-55965 | 6.5 | Mar 26 | An issue was discovered in Appsmith before 1.51 Affected: before 1.51 |
| CVE-2024-51408 | 6.5 | Nov 4 | AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials Affected: 1.8.3 before 1.46 |
| CVE-2022-4096 | 6.5 | Nov 21 | Server-Side Request Forgery (SSRF) in appsmithorg/appsmith Affected: before 1.8.2 |
| CVE-2026-7299 | 5.4 | Jun 2 | No description published yet Affected: before 2.1 |
| CVE-2026-34411 | 5.3 | Mar 27 | Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs Affected: before 1.98.0 |
| CVE-2024-55604 | 4.3 | Mar 25 | Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources Affected: before 1.51 |
| CVE-2022-38299 | 4.3 | Sep 12 | An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint Affected: 1.7.11 |
| CVE-2026-49979 | 2.7 | Jun 24 | Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter Affected: before 1.99 |
Showing 19