appsmithorg appsmith

• CVE-2026-49979 Medium 5.1 Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter 0.4%
• CVE-2026-55454 Critical 9.9 Appsmith: Caddy admin API exposed without authentication 0.6%
• CVE-2026-55455 Medium 5.3 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist 0.4%
• CVE-2026-50189 High 8.9 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route 0.5%
• CVE-2026-5418 High 7.3 appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery 0.3%
• CVE-2026-30862 Critical 9.1 Critical Stored XSS & Privilege Escalation in Appsmith 0.4%
• CVE-2026-24042 Critical 9.4 Appsmith public apps can execute unpublished actions (viewMode confusion) 0.6%
• CVE-2026-22794 Critical 9.7 Account Takeover Vulnerability in Appsmith 0.4%
• CVE-2024-55604 Medium 4.8 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources 0.3%