FR
Product
freescout
74
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 10High 28Medium 34Low 2
Watch
Add freescout to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53593 | 8.8 | Jul 20 | FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 Affected: < 1.8.224 |
| CVE-2026-27636 | 8.8 | Feb 25 | FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache Affected: < 1.8.206 |
| CVE-2025-58163 | 8.8 | Sep 3 | FreeScout's deserialization of untrusted data can lead to Remote Code Execution Affected: < 1.8.186 |
| CVE-2025-54366 | 8.8 | Jul 26 | FreeScout's deserialization of untrusted data leads to Remote Code Execution Affected: < 1.8.186 |
| CVE-2025-48476 | 8.8 | May 30 | FreeScout Has Business Logic Errors Affected: < 1.8.180 |
| CVE-2026-53591 | 8.6 | Jul 20 | FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails Affected: < 1.8.223 |
| CVE-2026-40568 | 8.5 | Apr 21 | FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization Affected: < 1.8.213 |
| CVE-2026-40497 | 8.1 | Apr 21 | FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) Affected: < 1.8.213 |
| CVE-2026-32752 | 8.1 | Mar 19 | FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages Affected: < 1.8.209 |
| CVE-2026-28289 | 8.1 | Mar 3 | FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution Affected: < 1.8.207 |
| CVE-2025-48477 | 8.1 | May 30 | FreeScout Has Business Logic Errors Affected: < 1.8.180 |
| CVE-2025-48475 | 8.1 | May 29 | FreeScout Vulnerable to Insufficient Authorization Affected: < 1.8.180 |
| CVE-2025-48474 | 8.1 | May 29 | FreeScout Vulnerable to Insufficient Authorization Affected: < 1.8.180 |
| CVE-2025-48472 | 8.1 | May 29 | FreeScout Vulnerable to Insufficient Authorization Affected: < 1.8.179 |
| CVE-2026-41905 | 7.7 | May 7 | FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access Affected: < 1.8.217 |
| CVE-2026-41904 | 7.6 | May 7 | FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content Affected: < 1.8.217 |
| CVE-2026-40589 | 7.6 | Apr 21 | FreeScout has Customer Edit Cross-Mailbox Email Takeover Affected: < 1.8.214 |
| CVE-2026-39384 | 7.6 | Apr 7 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass Affected: < 1.8.212 |
| CVE-2026-48812 | 7.5 | Jul 20 | FreeScout Allows Unauthenticated Access to Legacy Attachment Files Affected: < 1.8.221 |
| CVE-2026-47123 | 7.5 | May 29 | FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path Affected: < 1.8.220 |
| CVE-2025-48390 | 7.2 | May 29 | FreeScout Vulnerable to Remote Code Execution (RCE) Affected: < 1.8.178 |
| CVE-2025-48389 | 7.2 | May 29 | FreeScout Vulnerable to Deserialization of Untrusted Data Affected: < 1.8.178 |
| CVE-2026-41906 | 7.1 | May 7 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass Affected: < 1.8.214 |
| CVE-2026-41192 | 7.1 | Apr 21 | FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments Affected: < 1.8.215 |
| CVE-2026-41191 | 7.1 | Apr 21 | FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes Affected: < 1.8.215 |
| CVE-2026-41190 | 7.1 | Apr 21 | FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection Affected: < 1.8.215 |
| CVE-2026-41189 | 7.1 | Apr 21 | FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads Affected: < 1.8.215 |
| CVE-2026-40591 | 7.1 | Apr 21 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification Affected: < 1.8.214 |
Showing 28