[ Vendor · 18 CVEs ]
espocrm
CVEs affecting espocrm published in the last 30 days, plus any espocrm CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-75505 | 15 Oct 2026 | CVSS 6.0 | espocrmEspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply… | |
| CVE-2026-59994 | 15 Oct 2026 | CVSS 4.3 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a… | |
| CVE-2026-63130 | 15 Oct 2026 | CVSS 5.5 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to… | |
| CVE-2026-77460 | 15 Oct 2026 | CVSS 6.5 | espocrmEspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email… | |
| CVE-2026-53574 | 15 Oct 2026 | CVSS 7.6 | espocrmEspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a… | |
| CVE-2026-53575 | 15 Oct 2026 | CVSS 2.7 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in… | |
| CVE-2026-55154 | 15 Oct 2026 | CVSS 5.4 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php… | |
| CVE-2026-55184 | 15 Oct 2026 | CVSS 3.5 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission… | |
| CVE-2026-46691 | 15 Oct 2026 | CVSS 6.5 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST… | |
| CVE-2026-46694 | 15 Oct 2026 | CVSS 6.5 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can… | |
| CVE-2026-46708 | 15 Oct 2026 | CVSS 4.3 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can… | |
| CVE-2026-47168 | 15 Oct 2026 | CVSS 9.1 | espocrmEspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized… | |
| CVE-2026-109959 | 13 Oct 2026 | CVSS 4.3 | espocrmEspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by… | |
| CVE-2026-109957 | 13 Oct 2026 | CVSS 4.3 | espocrmEspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read… | |
| CVE-2026-109958 | 13 Oct 2026 | CVSS 4.3 | espocrmEspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values… | |
| CVE-2026-105831 | 8 Oct 2026 | CVSS 4.3 | espocrmEspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead… | |
| CVE-2026-105832 | 8 Oct 2026 | CVSS 4.3 | espocrmEspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring… | |
| CVE-2026-105833 | 8 Oct 2026 | CVSS 7.7 | espocrmEspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account… |