CVE-2026-55455 | Critical | 9.1 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by th… |
CVE-2026-55454 | Critical | 9.9 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authenti… |
CVE-2026-50189 | High | 7.2 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port… |
CVE-2026-49979 | Low | 2.7 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-c… |
CVE-2026-7299 | Medium | 6.3 | 2026-06-02 | Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated… |
CVE-2026-34411 | Medium | 5.3 | 2026-03-27 | Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /… |
CVE-2026-30862 | Critical | 9.0 | 2026-03-10 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (Ta… |
CVE-2026-24042 | Critical | 9.4 | 2026-01-22 | Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users… |
CVE-2026-22794 | Critical | 9.6 | 2026-01-12 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the e… |
CVE-2024-55965 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically… |
CVE-2024-55964 | Critical | 9.8 | 2025-03-26 | An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside t… |
CVE-2024-55963 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a serv… |
CVE-2024-55604 | Medium | 4.3 | 2025-03-25 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information o… |
CVE-2024-51408 | High | 8.5 | 2024-11-04 | AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials. |
CVE-2022-4096 | Medium | 6.5 | 2022-11-21 | Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. |
CVE-2022-38299 | Medium | 4.3 | 2022-09-12 | An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint. |
CVE-2022-38298 | High | 8.8 | 2022-09-12 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS… |
CVE-2022-39824 | High | 8.9 | 2022-09-05 | Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem pr… |