EspoCRM vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20233
3. 20241
4. 20256
5. 202632

Newest CVEs

• CVE-2026-118686

  EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

  espocrm · espocrm

  High8.7
• CVE-2026-75505

  EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

  espocrm · espocrm

  Medium6.0
• CVE-2026-77460

  EspoCRM: Mass email template renderer leaks restricted record fields

  espocrm · espocrm

  Medium6.5
• CVE-2026-63130

  EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete

  espocrm · espocrm

  Medium5.5
• CVE-2026-59994

  EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received

  espocrm · espocrm

  Medium4.3
• CVE-2026-55154

  EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

  espocrm · espocrm

  Medium5.4
• CVE-2026-55184

  EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled

  espocrm · espocrm

  Low3.5
• CVE-2026-53575

  EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

  espocrm · espocrm

  Low2.7
• CVE-2026-53574

  EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

  espocrm · espocrm

  High7.6
• CVE-2026-46691

  EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

  espocrm · espocrm

  Medium6.5