AP
Vendor
appsmithorg
19
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49979 | AP Appsmith Appsmith | 2.7 | Jun 24 | Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter |
| CVE-2026-55454 | AP Appsmith Appsmith | 9.9 | Jun 24 | Appsmith: Caddy admin API exposed without authentication |
| CVE-2026-55455 | AP Appsmith Appsmith | 9.1 | Jun 24 | Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist |
| CVE-2026-50189 | AP Appsmith Appsmith | 7.2 | Jun 24 | Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route |
| CVE-2026-7299 | AP Appsmith Appsmith | 5.4 | Jun 2 | No description published yet |
| CVE-2026-5418 | AP appsmith appsmithorg | 7.3 | Apr 2 | appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery |
| CVE-2026-34411 | AP Appsmith Appsmith | 5.3 | Mar 27 | Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs |
| CVE-2026-30862 | AP Appsmith Appsmith | 9.0 | Mar 9 | Critical Stored XSS & Privilege Escalation in Appsmith |
| CVE-2026-24042 | AP Appsmith Appsmith | 9.8 | Jan 22 | Appsmith public apps can execute unpublished actions (viewMode confusion) |
| CVE-2026-22794 | AP Appsmith Appsmith | 8.8 | Jan 12 | Account Takeover Vulnerability in Appsmith |
| CVE-2024-55963 | AP Appsmith Appsmith | 6.5 | Mar 26 | An issue was discovered in Appsmith before 1.51 |
| CVE-2024-55965 | AP Appsmith Appsmith | 6.5 | Mar 26 | An issue was discovered in Appsmith before 1.51 |
| CVE-2024-55964 | AP Appsmith Appsmith | 9.8 | Mar 26 | An issue was discovered in Appsmith before 1.52 |
| CVE-2024-55604 | AP Appsmith Appsmith | 4.3 | Mar 25 | Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources |
| CVE-2024-51408 | AP Appsmith Appsmith | 6.5 | Nov 4 | AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials |
| CVE-2022-4096 | AP Appsmith Appsmith | 6.5 | Nov 21 | Server-Side Request Forgery (SSRF) in appsmithorg/appsmith |
| CVE-2022-38299 | AP Appsmith Appsmith | 4.3 | Sep 12 | An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint |
| CVE-2022-38298 | AP Appsmith Appsmith | 8.8 | Sep 12 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata… |
| CVE-2022-39824 | AP Appsmith Appsmith | 8.9 | Sep 5 | Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list… |