Vulnerabilities

TI-2026-36812 CVE-2026-49979

Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

LOW 23

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00369 Published 2026-06-24 Fixed in 1.99 CWE-209

TI-2026-40018 CVE-2026-55454

Appsmith: Caddy admin API exposed without authentication

HIGH 76

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00603 Published 2026-06-24 Fixed in 2.1 CWE-1188

TI-2026-40019 CVE-2026-55455

Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

MEDIUM 57

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-06-24 Fixed in 2.1 CWE-918

TI-2026-36948 CVE-2026-50189

Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

HIGH 74

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00494 Published 2026-06-24 Fixed in 2.1 CWE-183

TI-2026-06406 CVE-2026-7299 · GHSA-6j63-xfwq-f8vj

Cross-site scripting in appsmithorg Appsmith

MEDIUM 61

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or co…

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00341 Published 2026-06-02 Fixed in 2.1 CWE-79

TI-2026-04745 CVE-2026-5418 · GHSA-jwc6-82xv-8pp5

appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery

HIGH 70

A vulnerability was identified in appsmithorg appsmith up to 1.97.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00314 Published 2026-04-02 Fixed in 1.99 CWE-918

TI-2026-26693 CVE-2026-34411 · GHSA-hvm5-gpg2-9x56

Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

LOW 37

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00394 Published 2026-03-27 Fixed in 1.98.0 CWE-306

TI-2026-23691 CVE-2026-30862

Critical Stored XSS & Privilege Escalation in Appsmith

HIGH 74

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00359 Published 2026-03-09 Fixed in 1.96 CWE-79

TI-2026-19370 CVE-2026-24042

Appsmith public apps can execute unpublished actions (viewMode confusion)

MEDIUM 50

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00642 Published 2026-01-22 No fix listed CWE-862

TI-2026-18312 CVE-2026-22794

Account Takeover Vulnerability in Appsmith

HIGH 76

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00386 Published 2026-01-12 Fixed in 1.93 CWE-346

TI-2024-37003 CVE-2024-55965 · GHSA-c77w-wgvp-cx35

An issue was discovered in Appsmith before 1.51.

LOW 29

An issue was discovered in Appsmith before 1.51.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00445 Published 2025-03-26 No fix listed CWE-863

TI-2024-37002 CVE-2024-55964

An issue was discovered in Appsmith before 1.52.

MEDIUM 58

An issue was discovered in Appsmith before 1.52.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06754 Published 2025-03-26 No fix listed CWE-94

TI-2024-37001 CVE-2024-55963

An issue was discovered in Appsmith before 1.51.

MEDIUM 54

An issue was discovered in Appsmith before 1.51.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.32863 Published 2025-03-26 No fix listed CWE-284

TI-2024-36913 CVE-2024-55604

Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

LOW 22

Appsmith is a platform to build admin panels, internal tools, and dashboards.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00252 Published 2025-03-25 Fixed in 1.51 CWE-280

TI-2024-34357 CVE-2024-51408 · GHSA-94hw-32gv-86pf

AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json…

HIGH 72

AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00483 Published 2024-11-04 No fix listed CWE-918

TI-2022-03744 CVE-2022-4096 · GHSA-cq38-9f6p-96j8

Server-Side Request Forgery (SSRF) in appsmithorg/appsmith

MEDIUM 62

Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0163 Published 2022-11-21 Fixed in 1.8.2 CWE-918

TI-2022-17957 CVE-2022-38299 · GHSA-v6wm-h278-4mr8

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect…

LOW 21

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00584 Published 2022-09-12 No fix listed

TI-2022-17956 CVE-2022-38298 · GHSA-8fww-hhqw-438g

Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated…

LOW 39

Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00758 Published 2022-09-12 No fix listed CWE-918

TI-2022-18822 CVE-2022-39824 · GHSA-grcg-mvxj-m89r

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to…

MEDIUM 41

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or ac…

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.01119 Published 2022-09-05 No fix listed CWE-79

Vulnerabilities

Filters