E
Vendor security profile
espocrm
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical0
CISA KEV0
Public exploit1
Patch rate%10
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
1
0
0
0
0
0
0
3
6
CVE KEV
CVE severity distribution
10toplam CVE
High3 (30%)
Medium7 (70%)
Patch and exploitation view
%10
Verified patch
%0
CISA KEV
%10
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
5.3
CVE-2026-109959
EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
E
Patch status unknown
5.3
CVE-2026-109958
EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
E
Patch status unknown
5.3
CVE-2026-109957
EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
E
Patch status unknown
8.3
CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
E
Patch status unknownEPSS %0
5.3
CVE-2026-105832
EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
E
Patch status unknownEPSS %0
5.3
CVE-2026-105831
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
E
Patch status unknownEPSS %0
4.8
CVE-2026-92298
EspoCRM through 10.0.8 Weak Token Generation via rand()
E
Patch verifiedEPSS %0
8.7
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
E
Patch status unknownEPSS %0
6.9
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
E
Patch status unknownEPSS %0
8.1
CVE-2020-37094
Vulnerability in Espocrm
E
Patch status unknownEPSS %1