Login Request a demo
AP
Product
appsmith
by appsmithorg · last CVE Jun 24, 2026
8
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 4High 2Medium 1Low 1
Severity
All severities8Critical4High2Medium1Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add appsmith to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55454
9.9
1%
Jun 24
Appsmith: Caddy admin API exposed without authentication
Affected: < 2.1
CVE-2026-24042
9.8
1%
Jan 22
Appsmith public apps can execute unpublished actions (viewMode confusion)
Affected: <= 1.94
CVE-2026-55455
9.1
0%
Jun 24
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
Affected: < 2.1
CVE-2026-30862
9.0
0%
Mar 9
Critical Stored XSS & Privilege Escalation in Appsmith
Affected: < 1.96
CVE-2026-22794
8.8
0%
Jan 12
Account Takeover Vulnerability in Appsmith
Affected: < 1.93
CVE-2026-50189
7.2
0%
Jun 24
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
Affected: < 2.1
CVE-2024-55604
4.3
0%
Mar 25
Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
Affected: < 1.51
CVE-2026-49979
2.7
0%
Jun 24
Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
Affected: < 1.99
Showing 8