Log in Start free

EspoCRM

Products

ProductCVEsExploitedLatest
EspoCRM43–Oct 28, 2026

Exploited and recent CVEs

  • CVE-2026-118686 High 7.5 EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex 0.3%
  • CVE-2026-75505 Medium 6.0 EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment 0.3%
  • CVE-2026-77460 Medium 6.5 EspoCRM: Mass email template renderer leaks restricted record fields 0.2%
  • CVE-2026-63130 Medium 5.5 EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete 0.3%
  • CVE-2026-59994 Medium 4.3 EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received 0.3%
  • CVE-2026-55154 Medium 5.4 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export 0.2%
  • CVE-2026-55184 Low 3.5 EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled 0.2%
  • CVE-2026-53575 Low 2.7 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user 0.2%
  • CVE-2026-53574 High 7.6 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression 0.2%
  • CVE-2026-46691 Medium 6.5 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users 0.2%
  • CVE-2026-46708 Medium 4.3 EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record 0.2%
  • CVE-2026-47168 Critical 9.1 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params 0.4%
  • CVE-2026-46694 Medium 6.5 EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes 0.2%
  • CVE-2026-109959 Medium 4.3 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint 0.2%
  • CVE-2026-109958 Medium 4.3 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search 0.2%
  • CVE-2026-109957 Medium 4.3 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter 0.2%
  • CVE-2026-105833 High 7.7 EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords 0.2%
  • CVE-2026-105832 Medium 4.3 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes 0.3%
  • CVE-2026-105831 Medium 4.3 EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form 0.3%
  • CVE-2026-92298 Medium 4.8 EspoCRM through 10.0.8 Weak Token Generation via rand() 0.4%
  • CVE-2026-90934 Medium 4.3 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees 0.3%
  • CVE-2026-88896 Medium 5.3 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass 0.4%
  • CVE-2026-41141 Medium 6.5 EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup 0.3%
  • CVE-2026-41160 Medium 4.3 EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes 0.3%
  • CVE-2026-33741 Medium 6.8 EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript 0.2%
  • CVE-2026-33733 High 7.2 EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete 0.4%
  • CVE-2026-33656 Critical 9.1 EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user 0.5%
  • CVE-2026-33740 Medium 5.4 EspoCRM: Email importEml can import and delete another user's attachment by raw fileId 0.2%
  • CVE-2026-33659 Low 3.5 EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access 0.3%
  • CVE-2026-33657 Medium 4.6 EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field 0.2%