E
Vendor security profile
espocrm
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical0
CISA KEV0
Public exploit1
Patch rate%14
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
1
0
0
0
0
0
0
3
3
CVE KEV
CVE severity distribution
7toplam CVE
High3 (43%)
Medium4 (57%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%14
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
8.3
CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
E
Patch status unknownEPSS %0
5.3
CVE-2026-105832
EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
E
Patch status unknownEPSS %0
5.3
CVE-2026-105831
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
E
Patch status unknownEPSS %0
4.8
CVE-2026-92298
EspoCRM through 10.0.8 Weak Token Generation via rand()
E
Patch verifiedEPSS %0
8.7
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
E
Patch status unknownEPSS %0
6.9
CVE-2026-88896
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
E
Patch status unknownEPSS %0
8.1
CVE-2020-37094
Vulnerability in Espocrm
E
Patch status unknownEPSS %1