# freescout. Every CVE that names freescout among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header](https://agentprime.io/advisories/CVE-2026-107393.md) `CVE-2026-107393` · CVE record: freescout-help-desk freescout · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)](https://agentprime.io/advisories/CVE-2026-53596.md) `CVE-2026-53596` · CVE record: freescout-help-desk freescout · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL](https://agentprime.io/advisories/CVE-2026-53595.md) `CVE-2026-53595` · CVE record: freescout-help-desk freescout · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass, CWE-178, CWE-640 - [FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path](https://agentprime.io/advisories/CVE-2026-53594.md) `CVE-2026-53594` · CVE record: freescout-help-desk freescout · CVSS 4.9 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Path traversal - [FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471](https://agentprime.io/advisories/CVE-2026-53593.md) `CVE-2026-53593` · CVE record: freescout-help-desk freescout · CVSS 8.8 High · Not analysed yet · Published 20 Jul 2026 · Tags: Unrestricted file upload - [FreeScout vulnerable to prototype pollution in getQueryParam](https://agentprime.io/advisories/CVE-2026-53592.md) `CVE-2026-53592` · CVE record: freescout-help-desk freescout · CVSS 4.6 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Prototype pollution - [FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails](https://agentprime.io/advisories/CVE-2026-53591.md) `CVE-2026-53591` · CVE record: freescout-help-desk freescout · CVSS 8.6 High · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass - [FreeScout Allows Unauthenticated Access to Legacy Attachment Files](https://agentprime.io/advisories/CVE-2026-48812.md) `CVE-2026-48812` · CVE record: freescout-help-desk freescout · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass - [FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint](https://agentprime.io/advisories/CVE-2026-45295.md) `CVE-2026-45295` · CVE record: freescout-help-desk freescout · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control - [FreeScout: User Account Enumeration via Password Reset Response Differentiation](https://agentprime.io/advisories/CVE-2026-45294.md) `CVE-2026-45294` · CVE record: freescout-help-desk freescout · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Information disclosure, CWE-204 - [FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path](https://agentprime.io/advisories/CVE-2026-47123.md) `CVE-2026-47123` · CVE record: freescout-help-desk freescout · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: Authentication bypass, CWE-345 - [FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check](https://agentprime.io/advisories/CVE-2026-48810.md) `CVE-2026-48810` · CVE record: freescout-help-desk freescout · CVSS 4.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Broken access control - [FreeScout: Thread Deletion Bypasses Mailbox Access Revocation](https://agentprime.io/advisories/CVE-2026-48811.md) `CVE-2026-48811` · CVE record: freescout-help-desk freescout · CVSS 4.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Broken access control - [FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass](https://agentprime.io/advisories/CVE-2026-41906.md) `CVE-2026-41906` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access](https://agentprime.io/advisories/CVE-2026-41905.md) `CVE-2026-41905` · CVE record: freescout-help-desk freescout · CVSS 7.7 High · Not analysed yet · Published 7 May 2026 · Tags: Server-side request forgery (SSRF) - [FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content](https://agentprime.io/advisories/CVE-2026-41904.md) `CVE-2026-41904` · CVE record: freescout-help-desk freescout · CVSS 7.6 High · Not analysed yet · Published 7 May 2026 · Tags: Cross-site scripting (XSS) - [FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks](https://agentprime.io/advisories/CVE-2026-41902.md) `CVE-2026-41902` · CVE record: freescout-help-desk freescout · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Authentication bypass - [FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)](https://agentprime.io/advisories/CVE-2026-41903.md) `CVE-2026-41903` · CVE record: freescout-help-desk freescout · CVSS 5.4 Medium · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable](https://agentprime.io/advisories/CVE-2026-41194.md) `CVE-2026-41194` · CVE record: freescout-help-desk freescout · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF) - [FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE](https://agentprime.io/advisories/CVE-2026-41193.md) `CVE-2026-41193` · CVE record: freescout-help-desk freescout · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Path traversal - [FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments](https://agentprime.io/advisories/CVE-2026-41192.md) `CVE-2026-41192` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes](https://agentprime.io/advisories/CVE-2026-41191.md) `CVE-2026-41191` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection](https://agentprime.io/advisories/CVE-2026-41190.md) `CVE-2026-41190` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads](https://agentprime.io/advisories/CVE-2026-41189.md) `CVE-2026-41189` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations](https://agentprime.io/advisories/CVE-2026-41183.md) `CVE-2026-41183` · CVE record: freescout-help-desk freescout · CVSS 4.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure - [FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply](https://agentprime.io/advisories/CVE-2026-40592.md) `CVE-2026-40592` · CVE record: freescout-help-desk freescout · CVSS 5.9 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification](https://agentprime.io/advisories/CVE-2026-40591.md) `CVE-2026-40591` · CVE record: freescout-help-desk freescout · CVSS 7.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout's Customer AJAX Create Modifies Hidden Existing Customer](https://agentprime.io/advisories/CVE-2026-40590.md) `CVE-2026-40590` · CVE record: freescout-help-desk freescout · CVSS 4.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout has Customer Edit Cross-Mailbox Email Takeover](https://agentprime.io/advisories/CVE-2026-40589.md) `CVE-2026-40589` · CVE record: freescout-help-desk freescout · CVSS 7.6 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII](https://agentprime.io/advisories/CVE-2026-40570.md) `CVE-2026-40570` · CVE record: freescout-help-desk freescout · CVSS 5.7 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration](https://agentprime.io/advisories/CVE-2026-40569.md) `CVE-2026-40569` · CVE record: freescout-help-desk freescout · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control - [FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization](https://agentprime.io/advisories/CVE-2026-40568.md) `CVE-2026-40568` · CVE record: freescout-help-desk freescout · CVSS 8.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables](https://agentprime.io/advisories/CVE-2026-40567.md) `CVE-2026-40567` · CVE record: freescout-help-desk freescout · CVSS 5.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-116 - [FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints](https://agentprime.io/advisories/CVE-2026-40566.md) `CVE-2026-40566` · CVE record: freescout-help-desk freescout · CVSS 4.1 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF) - [FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href](https://agentprime.io/advisories/CVE-2026-40565.md) `CVE-2026-40565` · CVE record: freescout-help-desk freescout · CVSS 6.1 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS) - [FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron](https://agentprime.io/advisories/CVE-2026-40498.md) `CVE-2026-40498` · CVE record: freescout-help-desk freescout · CVSS 8.9 High · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure, Broken access control, Denial of service - [FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)](https://agentprime.io/advisories/CVE-2026-40497.md) `CVE-2026-40497` · CVE record: freescout-help-desk freescout · CVSS 8.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS) - [FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force](https://agentprime.io/advisories/CVE-2026-40496.md) `CVE-2026-40496` · CVE record: freescout-help-desk freescout · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340 - [FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration](https://agentprime.io/advisories/CVE-2026-35584.md) `CVE-2026-35584` · CVE record: freescout-help-desk freescout · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Authentication bypass, Broken access control - [FreeScout Customer Merge Cross-Mailbox Authorization Bypass](https://agentprime.io/advisories/CVE-2026-39384.md) `CVE-2026-39384` · CVE record: freescout-help-desk freescout · CVSS 7.6 High · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control - [FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout](https://agentprime.io/advisories/CVE-2026-34442.md) `CVE-2026-34442` · CVE record: freescout-help-desk freescout · CVSS 5.4 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Open redirect, CWE-20, CWE-829 - [FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()](https://agentprime.io/advisories/CVE-2026-34443.md) `CVE-2026-34443` · CVE record: freescout-help-desk freescout · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Server-side request forgery (SSRF) - [FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})](https://agentprime.io/advisories/CVE-2026-32754.md) `CVE-2026-32754` · CVE record: freescout-help-desk freescout · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [FreeScout: Stored XSS through SVG file upload with filter bypass](https://agentprime.io/advisories/CVE-2026-32753.md) `CVE-2026-32753` · CVE record: freescout-help-desk freescout · CVSS 8.5 High · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS) - [FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages](https://agentprime.io/advisories/CVE-2026-32752.md) `CVE-2026-32752` · CVE record: freescout-help-desk freescout · CVSS 0.0 None · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control - [FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-28289.md) `CVE-2026-28289` · CVE record: freescout-help-desk freescout · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 3 Mar 2026 · Tags: Unrestricted file upload - [FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache](https://agentprime.io/advisories/CVE-2026-27636.md) `CVE-2026-27636` · CVE record: freescout-help-desk freescout · CVSS 8.8 High · Not analysed yet · Published 25 Feb 2026 · Tags: Unrestricted file upload - [FreeScout's Predictable Authentication Token Enables Account Takeover](https://agentprime.io/advisories/CVE-2026-27637.md) `CVE-2026-27637` · CVE record: freescout-help-desk freescout · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Weak cryptography or TLS - [FreeScout's deserialization of untrusted data can lead to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-58163.md) `CVE-2025-58163` · CVE record: freescout-help-desk freescout · CVSS 8.6 High · Not analysed yet · Published 3 Sept 2025 · Tags: Insecure deserialization - [FreeScout's deserialization of untrusted data leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-54366.md) `CVE-2025-54366` · CVE record: freescout-help-desk freescout · CVSS 8.6 High · Not analysed yet · Published 26 Jul 2025 · Tags: Insecure deserialization - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48488.md) `CVE-2025-48488` · CVE record: freescout-help-desk freescout · CVSS 4.6 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout has Race Condition When Deleting Users](https://agentprime.io/advisories/CVE-2025-48880.md) `CVE-2025-48880` · CVE record: freescout-help-desk freescout · CVSS 5.1 Medium · Not analysed yet · Published 30 May 2025 · Tags: Race condition - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48875.md) `CVE-2025-48875` · CVE record: freescout-help-desk freescout · CVSS 4.6 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48489.md) `CVE-2025-48489` · CVE record: freescout-help-desk freescout · CVSS 4.6 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48487.md) `CVE-2025-48487` · CVE record: freescout-help-desk freescout · CVSS 6.0 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48486.md) `CVE-2025-48486` · CVE record: freescout-help-desk freescout · CVSS 6.1 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48485.md) `CVE-2025-48485` · CVE record: freescout-help-desk freescout · CVSS 6.1 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Vulnerable to Stored XSS](https://agentprime.io/advisories/CVE-2025-48484.md) `CVE-2025-48484` · CVE record: freescout-help-desk freescout · CVSS 4.6 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS) - [FreeScout Stored XSS leads to CSRF](https://agentprime.io/advisories/CVE-2025-48483.md) `CVE-2025-48483` · CVE record: freescout-help-desk freescout · CVSS 6.3 Medium · Not analysed yet · Published 30 May 2025 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF) - [FreeScout Has Business Logic Errors](https://agentprime.io/advisories/CVE-2025-48482.md) `CVE-2025-48482` · CVE record: freescout-help-desk freescout · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2025 · Tags: CWE-841 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .