FR
Product
freescout
74
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 10High 28Medium 34Low 2
Watch
Add freescout to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-48880 | 6.6 | May 30 | FreeScout has Race Condition When Deleting Users Affected: < 1.8.181 |
| CVE-2026-45295 | 6.5 | Jul 20 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint Affected: < 1.8.219 |
| CVE-2026-35584 | 6.5 | Apr 7 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration Affected: < 1.8.212 |
| CVE-2025-48388 | 6.5 | May 29 | FreeScout Has Insufficient Protection Against CRLF-injection Affected: < 1.8.178 |
| CVE-2026-107393 | 6.1 | Oct 8 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header Affected: < 1.8.235 |
| CVE-2026-40565 | 6.1 | Apr 21 | FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href Affected: < 1.8.213 |
| CVE-2026-34442 | 6.1 | Mar 31 | FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout Affected: < 1.8.211 |
| CVE-2026-40592 | 5.9 | Apr 21 | FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply Affected: < 1.8.214 |
| CVE-2026-40567 | 5.8 | Apr 21 | FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables Affected: < 1.8.213 |
| CVE-2026-40570 | 5.7 | Apr 21 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII Affected: < 1.8.213 |
| CVE-2026-41903 | 5.4 | May 7 | FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) Affected: < 1.8.217 |
| CVE-2026-41194 | 5.4 | Apr 21 | FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable Affected: < 1.8.215 |
| CVE-2026-32753 | 5.4 | Mar 19 | FreeScout: Stored XSS through SVG file upload with filter bypass Affected: < 1.8.209 |
| CVE-2025-48488 | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.180 |
| CVE-2025-48875 | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.181 |
| CVE-2025-48486 | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.180 |
| CVE-2025-48485 | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.180 |
| CVE-2025-48484 | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.178 |
| CVE-2025-48483 | 5.4 | May 30 | FreeScout Stored XSS leads to CSRF Affected: < 1.8.180 |
| CVE-2026-53596 | 5.3 | Jul 20 | FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) Affected: < 1.8.224 |
| CVE-2026-45294 | 5.3 | May 29 | FreeScout: User Account Enumeration via Password Reset Response Differentiation Affected: < 1.8.219 |
| CVE-2026-34443 | 5.3 | Mar 31 | FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() Affected: < 1.8.211 |
| CVE-2026-53594 | 4.9 | Jul 20 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path Affected: < 1.8.224 |
| CVE-2025-48478 | 4.9 | May 30 | FreeScout Has Business Logic Errors Affected: < 1.8.180 |
| CVE-2025-48489 | 4.8 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.180 |
| CVE-2025-48487 | 4.8 | May 30 | FreeScout Vulnerable to Stored XSS Affected: < 1.8.180 |
| CVE-2026-53592 | 4.6 | Jul 20 | FreeScout vulnerable to prototype pollution in getQueryParam Affected: < 1.8.223 |
| CVE-2026-48810 | 4.3 | May 29 | FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check Affected: < 1.8.221 |
| CVE-2026-48811 | 4.3 | May 29 | FreeScout: Thread Deletion Bypasses Mailbox Access Revocation Affected: < 1.8.221 |
| CVE-2026-41183 | 4.3 | Apr 21 | FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations Affected: < 1.8.215 |
| CVE-2026-40590 | 4.3 | Apr 21 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer Affected: < 1.8.214 |
| CVE-2025-48482 | 4.3 | May 30 | FreeScout Has Business Logic Errors Affected: < 1.8.180 |
| CVE-2025-48473 | 4.3 | May 29 | FreeScout Vulnerable to Insufficient Authorization Affected: < 1.8.179 |
| CVE-2026-40566 | 4.1 | Apr 21 | FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints Affected: < 1.8.213 |
Showing 34