Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-55455 · Other software · appsmithorg · reported by GitHubMedium 5.3
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-55454 · Other software · appsmithorg · reported by GitHubCritical 9.9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-50189 · Other software · appsmithorg · reported by GitHubHigh 8.9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-49979 · Other software · appsmithorg · reported by GitHubMedium 5.1
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated DCVE-2026-7299 · Other software · Appsmith · reported by cret@cert.orgMedium 6.3
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability was identified in appsmithorg appsmith up to 1.97.CVE-2026-5418 · Other software · appsmithorg · reported by VulDBMedium 5.5
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication.CVE-2026-34411 · Other software · Appsmith · reported by VulnCheckMedium 6.9
Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 10, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-30862 · Other software · appsmithorg · reported by GitHubCritical 9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-24042 · Other software · appsmithorg · reported by GitHubCritical 9.4
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-22794 · Other software · appsmithorg · reported by GitHubCritical 9.6
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root.CVE-2025-41240 · Other software · VMware · reported by security@vmware.comCritical 10
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments using the default value of usePasswordFiles=true, which mounts secrets as files into the container filesystem.
- Product
- bitnamicharts/appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025An issue was discovered in Appsmith before 1.51.CVE-2024-55965 · Other software · Appsmith · reported by MITREMedium 6.5
An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025An issue was discovered in Appsmith before 1.52.CVE-2024-55964 · Other software · Appsmith · reported by MITRECritical 9.8
An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that datasource, and execute that query.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025An issue was discovered in Appsmith before 1.51.CVE-2024-55963 · Other software · Appsmith · reported by MITREMedium 6.5
An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2024-55604 · Other software · appsmithorg · reported by GitHubMedium 4.8
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.CVE-2024-51408 · Other software · appsmith · reported by MITREHigh 8.5
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.CVE-2022-4096 · Other software · appsmithorg · reported by security@huntr.devMedium 6.5
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
- Product
- appsmithorg/appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.CVE-2022-38299 · Other software · Appsmith · reported by MITREMedium 4.3
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS iCVE-2022-38298 · Other software · Appsmith · reported by MITREHigh 8.8
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2022Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem proCVE-2022-39824 · Other software · Appsmith · reported by MITREHigh 8.9
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.