# Espocrm vulnerabilities Source: https://junglewise.ai/threats/vendors/espocrm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/espocrm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in Espocrm: 0 in the last 7 days and 13 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118686, was published on 28 October 2026. 10 vulnerabilities in the last four weeks, up 400% on the four before (2). 1 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 13 - All time: 23 (2 critical, 0 exploited in the wild) ## About Espocrm EspoCRM is an open-source customer relationship management software provider. ## Latest Espocrm vulnerabilities - [CVE-2026-118686: EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial) (high, CVSS 7.5, published 28 Oct 2026) - [CVE-2026-113643: EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this) (medium, CVSS 4.3, published 20 Oct 2026) - [CVE-2026-75505: EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management) (info, published 15 Oct 2026) - [CVE-2026-59994: EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management) (medium, CVSS 4.3, published 15 Oct 2026) - [CVE-2026-55154: EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-47168: EspoCRM unsafe deserialization in MassAction and Export](https://junglewise.ai/threats/cve-2026-47168-espocrm-is-an-open-source-customer-relationship-management) (critical, CVSS 9.1, published 15 Oct 2026) - [CVE-2026-46694: EspoCRM unauthorized access to internal stream notes](https://junglewise.ai/threats/cve-2026-46694-espocrm-is-an-open-source-customer-relationship-management) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-109959: EspoCRM access control bypass in Note endpoint](https://junglewise.ai/threats/cve-2026-109959-espocrm-4-0-0-before-10-0-7-contains-an-access-control) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109958: EspoCRM improper access control in address-book search](https://junglewise.ai/threats/cve-2026-109958-espocrm-4-0-0-before-10-0-7-contains-an-improper-access-control) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-109957: EspoCRM insecure direct object reference in Import attachment handling](https://junglewise.ai/threats/cve-2026-109957-espocrm-before-10-0-7-contains-an-insecure-direct-object) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-92298: EspoCRM weak random token generation for opt-in and invitations](https://junglewise.ai/threats/cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations) (medium, CVSS 4.8, published 16 Sep 2026) - [CVE-2026-90934: EspoCRM field-level security bypass in attendees endpoints](https://junglewise.ai/threats/cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-88896: EspoCRM server-side request forgery via IPv6 transition address bypass](https://junglewise.ai/threats/cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address) (medium, CVSS 5.3, published 10 Sep 2026) - [CVE-2026-41160: EspoCRM broken access control in Note Pinning API](https://junglewise.ai/threats/cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api) (medium, CVSS 4.3, published 28 May 2026) - [CVE-2026-41141: EspoCRM IDOR in EmailTemplate endpoint leaks entity data](https://junglewise.ai/threats/cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data) (medium, CVSS 6.5, published 28 May 2026) - [CVE-2026-33741: EspoCRM stored XSS via SVG and JavaScript attachments](https://junglewise.ai/threats/cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments) (medium, CVSS 6.8, published 19 May 2026) - [CVE-2026-33733: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template…](https://junglewise.ai/threats/cve-2026-33733-espocrm-is-an-open-source-customer-relationship-management) (high, CVSS 7.2, published 22 Apr 2026) - [CVE-2026-33656: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in…](https://junglewise.ai/threats/cve-2026-33656-espocrm-is-an-open-source-customer-relationship-management) (critical, CVSS 9.1, published 22 Apr 2026) - [CVE-2026-33740: EspoCRM IDOR in Email importEml endpoint](https://junglewise.ai/threats/cve-2026-33740-espocrm-idor-in-email-importeml-endpoint) (medium, CVSS 5.4, published 13 Apr 2026) - [CVE-2026-33659: EspoCRM SSRF via DNS rebinding in Attachment fromImageUrl](https://junglewise.ai/threats/cve-2026-33659-espocrm-ssrf-via-dns-rebinding-in-attachment-fromimageurl) (low, CVSS 3.5, published 13 Apr 2026) - [CVE-2026-33657: EspoCRM stored HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-33657-espocrm-stored-html-injection-in-email-notifications) (medium, CVSS 4.6, published 13 Apr 2026) - [CVE-2026-33534: EspoCRM SSRF via internal-host validation bypass in Attachment API](https://junglewise.ai/threats/cve-2026-33534-espocrm-ssrf-via-internal-host-validation-bypass-in-attachment) (medium, CVSS 4.3, published 13 Apr 2026) - [CVE-2020-37094: EspoCRM 2FA bypass via authentication token reuse](https://junglewise.ai/threats/cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse) (high, CVSS 8.1, published 3 Feb 2026) ## Most severe Espocrm vulnerabilities - [CVE-2026-33656: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in…](https://junglewise.ai/threats/cve-2026-33656-espocrm-is-an-open-source-customer-relationship-management) (critical, CVSS 9.1, published 22 Apr 2026) - [CVE-2026-47168: EspoCRM unsafe deserialization in MassAction and Export](https://junglewise.ai/threats/cve-2026-47168-espocrm-is-an-open-source-customer-relationship-management) (critical, CVSS 9.1, published 15 Oct 2026) - [CVE-2020-37094: EspoCRM 2FA bypass via authentication token reuse](https://junglewise.ai/threats/cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse) (high, CVSS 8.1, published 3 Feb 2026) - [CVE-2026-118686: EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial) (high, CVSS 7.5, published 28 Oct 2026) - [CVE-2026-33733: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template…](https://junglewise.ai/threats/cve-2026-33733-espocrm-is-an-open-source-customer-relationship-management) (high, CVSS 7.2, published 22 Apr 2026) - [CVE-2026-33741: EspoCRM stored XSS via SVG and JavaScript attachments](https://junglewise.ai/threats/cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments) (medium, CVSS 6.8, published 19 May 2026) - [CVE-2026-46694: EspoCRM unauthorized access to internal stream notes](https://junglewise.ai/threats/cve-2026-46694-espocrm-is-an-open-source-customer-relationship-management) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-41141: EspoCRM IDOR in EmailTemplate endpoint leaks entity data](https://junglewise.ai/threats/cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data) (medium, CVSS 6.5, published 28 May 2026) - [CVE-2026-55154: EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-33740: EspoCRM IDOR in Email importEml endpoint](https://junglewise.ai/threats/cve-2026-33740-espocrm-idor-in-email-importeml-endpoint) (medium, CVSS 5.4, published 13 Apr 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 400% on the four before (2). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 8 | 1 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Espocrm technologies - [EspoCRM](https://junglewise.ai/threats/technologies/espocrm): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Espocrm vulnerabilities", https://junglewise.ai/threats/vendors/espocrm, 13 November 2026.