I
Vendor security profile
invoiceshelf
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical0
CISA KEV0
Public exploit5
Patch rate%0
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
3
0
0
0
0
0
1
7
CVE KEV
CVE severity distribution
11toplam CVE
High9 (82%)
Medium2 (18%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%45
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
7.6
CVE-2026-55382
InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
I
Patch status unknown
6.8
CVE-2026-55385
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
I
Patch status unknown
7.1
CVE-2026-55381
InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates
I
Patch status unknown
8.2
CVE-2026-55383
InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
I
Patch status unknown
7.2
CVE-2026-55387
InvoiceShelf bulk deletion lacks company scoping
I
Patch status unknown
7.1
CVE-2026-55386
InvoiceShelf ORDER BY SQL injection through orderByField
I
Patch status unknown
5.3
CVE-2026-55384
InvoiceShelf trusts client-supplied document totals
I
Patch status unknown
8.7
CVE-2026-55610
InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
I
Patch status unknownEPSS %0
8.7
CVE-2026-34367
Server-side request forgery in Invoiceshelf
I
Patch status unknown Public Exploits:1EPSS %0
8.1
CVE-2026-34366
Server-side request forgery in Invoiceshelf
I
Patch status unknown Public Exploits:1EPSS %0