CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 4:23 AM ET)

What this means for you

This week: 3,084 CVEs published, 231 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,084; Show in the list
Critical, last 7 days: 231; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product espocrm:espocrm. Show all products

34 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2025-59428	Medium 5.4	EspoCRM allows arbitrary user creation via stored SVG injection and CSRF Assigned by GitHub_M	Oct 14, 2025
CVE-2020-37094	High 8.1	EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords Assigned by VulnCheck	Feb 3, 2026
CVE-2026-33534	Medium 4.3	EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation Assigned by GitHub_M	Apr 13, 2026
CVE-2026-33657	Medium 4.6	EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field Assigned by GitHub_M	Apr 13, 2026
CVE-2026-33659	Low 3.5	EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access Assigned by GitHub_M	Apr 13, 2026
CVE-2026-33740	Medium 5.4	EspoCRM: Email importEml can import and delete another user's attachment by raw fileId Assigned by GitHub_M	Apr 13, 2026
CVE-2026-33656	Critical 9.1	EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user Assigned by GitHub_M	Apr 22, 2026
CVE-2026-33733	High 7.2	EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete Assigned by GitHub_M	Apr 22, 2026
CVE-2026-33741	Medium 6.8	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript Assigned by GitHub_M	May 19, 2026
CVE-2026-41160	Medium 4.3	EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes Assigned by GitHub_M	May 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.