EspoCRM security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for EspoCRM. Vendor security advisories are linked on this page.
Built for Operators of this product.
39 public records · 0 security-fix timeline events. 0 published in the last 7 days. 17 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 4
- Medium 11
- Low 2
2026-08-0618 issues2026-11-03
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- High7.3Stored XSS in Knowledge Base articles letting run JS code on link clickOpen the advisoryOct 27, 2026
- High8.0SVG attachment opened in browser turns one click into authenticated API POST callOpen the advisoryOct 27, 2026
- Medium4.3EspoCRM is an open source customer relationship management application.Check if you run itEPSS 0.19%Oct 15, 2026
- Medium6.5EspoCRM is an open source customer relationship management application.Check if you run itEPSS 0.23%Oct 15, 2026
- Medium6.5EspoCRM is an open source customer relationship management application.Check if you run itEPSS 0.23%Oct 15, 2026
- Critical9.1EspoCRM is an open source customer relationship management application.Check if you run itEPSS 0.42%Oct 15, 2026
- High7.5Unauthenticated long body request loads CPU in the password-redaction regex, denying serviceOpen the advisoryOct 13, 2026
- Medium4.3PDF rendering allows users with edit access to PDF template scope to view image attachments with known ID they don't have access toCheck if you run itEPSS 0.38%Oct 13, 2026
- Medium4.3IDOR allowing users with access to Import scope to extract data from attachments with known IDCheck if you run itEPSS 0.20%Sep 29, 2026
- Medium4.3Address-book search does not check field-level access to emailAddress fieldCheck if you run itEPSS 0.22%Sep 29, 2026