影響を受けるバージョン系列
- 1.99 CVE 3 件
- 1.98 CVE 5 件
- 1.96 CVE 6 件
- 1.94 CVE 7 件
- 1.93 CVE 8 件
- 1.52 CVE 9 件
- 1.51 CVE 10 件
- 1.46 CVE 13 件
- 1.19 CVE 15 件
- 1.18 CVE 15 件
- 1.17 CVE 15 件
- 1.16 CVE 15 件
- 1.15 CVE 15 件
- 1.14 CVE 15 件
- 1.13 CVE 15 件
- 1.12 CVE 15 件
- 1.11 CVE 15 件
- 1.10 CVE 15 件
- 1.9 CVE 15 件
- 1.8 CVE 16 件
- 1.7 CVE 18 件
- 1.6 CVE 16 件
- 1.5 CVE 16 件
- 1.4 CVE 16 件
- 1.3 CVE 16 件
- 1.2 CVE 16 件
- 1.1 CVE 16 件
- 1.0 CVE 16 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-55455 | Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist | * < 2.1 | 5.3 | — | 2026-06-24 | |
| CVE-2026-55454 | Appsmith: Caddy admin API exposed without authentication | * < 2.1 | 9.9 | — | 2026-06-24 | |
| CVE-2026-49979 | Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter | * < 1.99 | 5.1 | — | 2026-06-24 | |
| CVE-2026-50189 | Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route | * < 2.1 | 8.9 | — | 2026-06-24 | |
| CVE-2026-7299 | CVE-2026-7299 | < 1.99 | 5.4 | — | 2026-06-02 | |
| CVE-2026-5418 | appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery | = 1.0 = 1.1 = 1.2 | 6.9 | — | 2026-04-03 | |
| CVE-2026-34411 | Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs | < 1.98.0 < 1.98 | 6.9 | — | 2026-03-27 | |
| CVE-2026-30862 | Critical Stored XSS & Privilege Escalation in Appsmith | * < 1.96 | 9.0 | — | 2026-03-10 | |
| CVE-2026-24042 | Appsmith public apps can execute unpublished actions (viewMode confusion) | * ≤ 1.94 | 9.8 | — | 2026-01-22 | |
| CVE-2026-22794 | Account Takeover Vulnerability in Appsmith | * < 1.93 | 8.8 | — | 2026-01-12 | |
| CVE-2024-55965 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to deve... | * < 1.51 | 6.5 | — | 2025-03-26 | |
| CVE-2024-55964 | An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith... | * < 1.52 | 9.8 | — | 2025-03-26 | |
| CVE-2024-55963 | An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can tr... | * < 1.51 | 6.5 | — | 2025-03-26 | |
| CVE-2024-55604 | Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources | * < 1.51 | 4.8 | — | 2025-03-25 | |
| CVE-2024-51408 | AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.1... | * ≥ 1.8.3 < 1.46 | 6.5 | — | 2024-11-04 | |
| CVE-2022-4096 | Server-Side Request Forgery (SSRF) in appsmithorg/appsmith | * < 1.8.2 | 6.5 | — | 2022-11-21 | |
| CVE-2022-38298 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SS... | * = 1.7.11 | 8.8 | — | 2022-09-12 | |
| CVE-2022-38299 | An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the A... | * = 1.7.11 | 4.3 | — | 2022-09-12 | |
| CVE-2022-39824 | Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaS... | * ≤ 1.7.14 | 8.9 | — | 2022-09-05 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。