CVE-2026-53596 | Medium | 5.3 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforc… |
CVE-2026-53595 | Critical | 9.4 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invi… |
CVE-2026-53594 | Medium | 4.9 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpout… |
CVE-2026-53593 | High | 8.8 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploa… |
CVE-2026-53592 | Medium | 4.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/… |
CVE-2026-53591 | High | 8.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages in… |
CVE-2026-48812 | High | 7.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token… |
CVE-2026-45295 | Medium | 6.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conv… |
CVE-2026-48811 | Medium | 4.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an… |
CVE-2026-48810 | Medium | 4.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reporte… |
CVE-2026-47123 | High | 7.5 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails c… |
CVE-2026-45294 | Medium | 5.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct resp… |
CVE-2026-41906 | High | 7.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-s… |
CVE-2026-41905 | High | 7.7 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php… |
CVE-2026-41904 | High | 7.6 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store a… |
CVE-2026-41903 | Medium | 5.4 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (int… |
CVE-2026-41902 | Critical | 9.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-chara… |
CVE-2026-41194 | Medium | 5.4 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented as `GET /mailbox/oau… |
CVE-2026-41193 | Critical | 9.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without v… |
CVE-2026-41192 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment ID… |
CVE-2026-41191 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside t… |
CVE-2026-41190 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversa… |
CVE-2026-41189 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, w… |
CVE-2026-41183 | Medium | 4.3 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view an… |
CVE-2026-40592 | Medium | 5.9 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks o… |
CVE-2026-40591 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `custo… |
CVE-2026-40590 | Medium | 4.3 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via PO… |
CVE-2026-40589 | High | 7.6 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, a low-privileged agent can edit a visible customer and add an email add… |
CVE-2026-40570 | | | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns co… |
CVE-2026-40569 | Critical | 9.0 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a mass assignment vulnerability in the mailbox connection settings… |
CVE-2026-40568 | High | 8.5 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox s… |
CVE-2026-40567 | Medium | 5.8 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can inject arbitrary HTML into outgoing ema… |
CVE-2026-40566 | Medium | 4.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMT… |
CVE-2026-40565 | Medium | 6.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-te… |
CVE-2026-40498 | Critical | 9.8 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that… |
CVE-2026-40497 | High | 8.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::stripDangerousTags()` removes `<script>`, `<form>`… |
CVE-2026-40496 | Critical | 9.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable f… |
CVE-2026-39384 | High | 7.6 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility… |
CVE-2026-35584 | Medium | 6.5 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id… |
CVE-2026-34443 | Medium | 5.3 | 2026-03-31 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whet… |
CVE-2026-34442 | Medium | 5.4 | 2026-03-31 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (htt… |
CVE-2026-32754 | Critical | 9.3 | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XS… |
CVE-2026-32753 | Medium | 5.4 | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG… |
CVE-2026-32752 | Unrated | | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a br… |
CVE-2026-28289 | Critical | 10.0 | 2026-03-03 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and ear… |
CVE-2026-27637 | Critical | 9.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predicta… |
CVE-2026-27636 | High | 8.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/M… |
CVE-2025-58163 | High | 8.8 | 2025-09-03 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vul… |
CVE-2025-54366 | High | 8.8 | 2025-07-26 | FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical d… |
CVE-2025-48880 | Medium | 6.6 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user, there is the the p… |
CVE-2025-48875 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of last_name and first_name during pr… |
CVE-2025-48489 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48488 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file c… |
CVE-2025-48487 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message… |
CVE-2025-48486 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of… |
CVE-2025-48485 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48484 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48483 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48482 | Medium | 4.3 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is update… |
CVE-2025-48481 | Critical | 9.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash… |
CVE-2025-48480 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege Us… |
CVE-2025-48479 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the laravel-translation-manager package does not correctly validate use… |
CVE-2025-48478 | Medium | 4.9 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a ma… |
CVE-2025-48477 | High | 8.1 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence… |
CVE-2025-48476 | High | 8.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is… |
CVE-2025-48475 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an… |
CVE-2025-48474 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations… |
CVE-2025-48473 | Medium | 4.3 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, th… |
CVE-2025-48472 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications fo… |
CVE-2025-48471 | Critical | 9.8 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of fil… |
CVE-2025-48390 | High | 7.2 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validatio… |
CVE-2025-48389 | High | 7.2 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to ins… |
CVE-2025-48388 | Medium | 6.5 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data… |