Log in Start free

appsmithorg

Products

ProductCVEsExploitedLatest
appsmith9–Jun 24, 2026
appsmithorg/appsmith1–Nov 21, 2022

Exploited and recent CVEs

  • CVE-2026-49979 Medium 5.1 Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter 0.4%
  • CVE-2026-55454 Critical 9.9 Appsmith: Caddy admin API exposed without authentication 0.6%
  • CVE-2026-55455 Medium 5.3 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist 0.4%
  • CVE-2026-50189 High 8.9 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route 0.5%
  • CVE-2026-5418 High 7.3 appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery 0.3%
  • CVE-2026-30862 Critical 9.1 Critical Stored XSS & Privilege Escalation in Appsmith 0.4%
  • CVE-2026-24042 Critical 9.4 Appsmith public apps can execute unpublished actions (viewMode confusion) 0.6%
  • CVE-2026-22794 Critical 9.7 Account Takeover Vulnerability in Appsmith 0.4%
  • CVE-2024-55604 Medium 4.8 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources 0.3%
  • CVE-2022-4096 High 8.8 Server-Side Request Forgery (SSRF) in appsmithorg/appsmith 1.6%