CVE-2026-5418

HighCVSS 7.3/10Last modified Jul 24, 2026

Description

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-541807.6backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c CVE-2026-541815.4backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c CVE-2026-541828.1backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c CVE-2026-541834.3Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-dept CVE-2026-541848.2Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.CVE-2026-541858.5Subscriber SQL Injection in Cornerstone < 7.8.8 versions.CVE-2026-541869.3Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.CVE-2026-541879.3Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.CVE-2026-541887.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-541897.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54193.7A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could all CVE-2026-541906.5Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.