Advisories · Technology
appsmith.
Every CVE that names appsmith among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
- appsmith
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Appsmith: Caddy admin API exposed without authentication
- appsmith
- CWE-749
- CWE-1188
- CVSS 5.3 Medium
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
- appsmith
- Server-side request forgery (SSRF)
- CVSS 8.9 High
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
- appsmith
- Server-side request forgery (SSRF)
- CWE-183
- CVSS 6.3 Medium
CVE-2026-7299
- Appsmith
- CVSS 6.9 Medium
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
- appsmith
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs
- Appsmith
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Critical Stored XSS & Privilege Escalation in Appsmith
- appsmith
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Appsmith public apps can execute unpublished actions (viewMode confusion)
- appsmith
- Broken access control
- CVSS 9.7 CriticalCritical · CVSS 9+
Account Takeover Vulnerability in Appsmith
- appsmith
- CWE-346
- CVSS 4.8 Medium
Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
- appsmith
- CWE-280