Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
89 results · page 1 of 2
Oct 13, 2026A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to CVE-2026-110385 · Other software · ONLYOFFICE · reported by MITREHigh 8.7
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a loCVE-2026-103903 · Network & remote access · MikroTik · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activCVE-2026-104445 · Other software · YesWiki · reported by VulnCheckHigh 8.8
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 1, 2026In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notificationsCVE-2026-103496 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox.CVE-2026-54649 · Other software · PunchIn-App · reported by GitHubLow 2.1
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0.
- Product
- punchin-email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome.CVE-2026-82808 · Other software · Inbox Foundry · reported by VulDBMedium 5.5
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."
- Product
- ActiveInbox Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53596 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53595 · Other software · freescout-help-desk · reported by GitHubCritical 9.4
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53594 · Other software · freescout-help-desk · reported by GitHubMedium 4.9
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53593 · Other software · freescout-help-desk · reported by GitHubHigh 8.8
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restricted_extensions`) is incomplete: it does not cover the `.pht` extension. The authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) stores files with their original extension into the web-accessible directory `storage/app/public/uploads/` (served at `/storage/uploads/`). On the standard Apache + `libapache2-mod-php` deployment, the default handler `<FilesMatch ".+\.ph(ar|p[3457]?|t|tml)$">` executes `.pht`, so **any authenticated agent can upload a `.pht` web shell and run arbitrary commands as the web-server user** (`www-data`). This is a direct bypass of the fix for CVE-2025-48471, which added `phtml`/`phar` but not `pht` (nor `phtm`, `phps`). Version 1.8.224 contains an updated fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53592 · Other software · freescout-help-desk · reported by GitHubMedium 4.6
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-53591 · Other software · freescout-help-desk · reported by GitHubHigh 8.6
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-48812 · Other software · freescout-help-desk · reported by GitHubHigh 7.5
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-45295 · Other software · freescout-help-desk · reported by GitHubMedium 6.5
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`).CVE-2026-58482 · Other software · Jovancoding · reported by GitHubMedium 5.9
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Be
- Product
- Network-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read roCVE-2026-64622 · Other software · Jovancoding · reported by VulnCheckCritical 9.3
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
- Product
- Network-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 29, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-48811 · Other software · freescout-help-desk · reported by GitHubMedium 4.3
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-48810 · Other software · freescout-help-desk · reported by GitHubMedium 4.3
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling ThreadPolicy::edit method. A user with the PERM_EDIT_CONVERSATIONS permission who created a message or internal note in Mailbox A can rewrite that thread's body after an administrator removes them from Mailbox A, because the policy checks only authorship and a global permission flag — not current mailbox membership. This vulnerability is fixed in 1.8.221.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-47123 · Other software · freescout-help-desk · reported by GitHubHigh 7.5
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies — which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-45294 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Inbox Zero is an AI personal assistant for email.CVE-2026-42865 · Other software · elie222 · reported by GitHubLow 2.3
Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.
- Product
- inbox-zero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-41906 · Other software · freescout-help-desk · reported by GitHubHigh 7.1
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers through the mailbox-filtered search endpoint, but the backend conversation_change_customer action accepts any supplied customer_email. A low-privileged agent can forge a request and bind a visible conversation to a hidden customer in another mailbox. This issue has been patched in version 1.8.214.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-41905 · Other software · freescout-help-desk · reported by GitHubHigh 7.7
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl() but then re-validates the original URL instead of the final redirect destination. An attacker who can supply any URL that passes the initial host check can redirect FreeScout to internal HTTP services (cloud metadata, internal APIs, RFC1918 ranges) that would normally be blocked. This issue has been patched in version 1.8.217.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-41904 · Other software · freescout-help-desk · reported by GitHubHigh 7.6
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-41903 · Other software · freescout-help-desk · reported by GitHubMedium 5.4
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended for general user-profile editing) can read and modify the notification subscriptions of any other user, including admins, by sending a single POST request. This is a sibling of CVE-2025-48472's notification authorization bypass — the prior fix did not cover this code path. A non-admin attacker can silently disable an admin's email/browser/mobile notifications, suppressing security alerts and conversation-assignment notices. This issue has been patched in version 1.8.217.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-41902 · Other software · freescout-help-desk · reported by GitHubCritical 9.1
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected deCVE-2026-20035 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.2
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.
- Product
- Cisco Unity Connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-39384 · Other software · freescout-help-desk · reported by GitHubHigh 7.6
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-35584 · Other software · freescout-help-desk · reported by GitHubMedium 6.9
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-34443 · Other software · freescout-help-desk · reported by GitHubMedium 6.9
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-34442 · Other software · freescout-help-desk · reported by GitHubMedium 5.4
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-32754 · Other software · freescout-help-desk · reported by GitHubCritical 9.3
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-32753 · Other software · freescout-help-desk · reported by GitHubHigh 8.5
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of .png with content type of image/svg+xml is allowed, and a fallback mechanism on invalid XML leads to unsafe sanitization. The application restricts which uploaded files are rendered inline: only files considered "safe" are displayed in the browser; others are served with Content-Disposition: attachment. This decision is based on two checks: the file extension (e.g. .png is allowed, while .svg may not be) and the declared Content-Type (e.g. image/* is allowed). By using a filename with an allowed extension (e.g. xss.png) and a Content-Type of image/svg+xml, an attacker can satisfy both checks and cause the server to treat the upload as a safe image and render it inline, even though the body is SVG and can contain scripted behavior. Any authenticated user can set up a specific URL, and whenever another user or administrator visits it, XSS can perform any action on their behalf. This issue has been fixed in version 1.8.209.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-32752 · Other software · freescout-help-desk · reported by GitHubNone
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-28289 · Other software · freescout-help-desk · reported by GitHubCritical 10
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-27637 · Other software · freescout-help-desk · reported by GitHubCritical 9.8
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predictable authentication token computed as `MD5(user_id + created_at + APP_KEY)`. This token is static (never expires/rotates), and if an attacker obtains the `APP_KEY` — a well-documented and common exposure vector in Laravel applications — they can compute a valid token for any user, including the administrator, achieving full account takeover without any password. This vulnerability can be exploited on its own or in combination with CVE-2026-27636. Version 1.8.206 fixes both vulnerabilities.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-27636 · Other software · freescout-help-desk · reported by GitHubHigh 8.8
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2026-21219 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access aCVE-2025-41077 · Other software · Viafirma · reported by cve-coordination@incibe.esHigh 8.6
IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.
- Product
- Inbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.CVE-2025-15464 · Other software · yintibao · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 7.5
Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.
- Product
- Fun Print Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Dec 30, 2025Inboxify Sign Up Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69008 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.
- Product
- Inboxify Sign Up Form
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Inboxify Sign Up Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2025Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute codeCVE-2025-59282 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comvicarius.io
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58738 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58736 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58735 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58734 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58732 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58731 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-58730 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.