8
CVEs
1
Critical
3
High
0
KEV
1
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53595 | Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id activated agent or administrator account by abusing the public POST /user-setup/{hash}/{invite_sent_at} endpoint. By supplying a single URL-encoded space as the invite hash and a plaintext numeric timestamp, the attacker overwrites the target's email and password and is logged in as that user. No public exploit is identified at time of analysis, but the mechanics are fully disclosed in the GitHub advisory and CVSS is 9.4. | CRITICAL | 9.4 | 0.3% | 67 |
PoC
|
| CVE-2026-53593 | Authenticated remote code execution in FreeScout help desk prior to version 1.8.224 allows any logged-in agent to upload a malicious .pht file that executes as PHP on the default Apache plus libapache2-mod-php stack, yielding arbitrary command execution as the www-data user. The flaw is a denylist bypass: the restricted-extension filter added by the earlier CVE-2025-48471 fix blocked phtml and phar but missed .pht (as well as .phtm and .phps), which Apache's default FilesMatch handler still runs as PHP. No public exploit or CISA KEV listing is identified at time of analysis, but the technique is well understood and low-complexity given a valid agent account. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-53591 | Message injection in FreeScout self-hosted help desk (all versions prior to 1.8.223) lets a remote unauthenticated attacker forge customer replies inside any existing support conversation. By emailing the helpdesk's public intake address with a crafted In-Reply-To header that references a target thread, the attacker's message renders in the agent UI as a legitimate customer reply, silently reopens the conversation, and overwrites last_reply_from with the attacker's identity. No credentials, tokens, or prior access are required (CVSS 8.6); no public exploit has been identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-48812 | Broken authentication in FreeScout (a PHP/Laravel self-hosted help desk and shared inbox) prior to version 1.8.221 lets an unauthenticated remote attacker download arbitrary attachments whose token_type is set to 1 (TOKEN_TYPE_LEGACY). The download route bypasses token verification for these legacy attachments, and because file paths are deterministic, any attachment created by an older FreeScout instance can be retrieved without a valid token or session. There is no public exploit identified at time of analysis, but the upstream commit disclosing the exact flawed conditional is public. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-45295 | Unauthenticated access to FreeScout's email open-tracking endpoint (`GET /thread/read/{conversation_id}/{thread_id}`) allows remote attackers to enumerate valid conversation and thread IDs and manipulate the `opened_at` timestamp on arbitrary threads. All FreeScout deployments prior to version 1.8.219 are affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-53596 | Uncontrolled resource consumption in FreeScout's file upload endpoint allows any user to flood the server with upload requests, overloading the database and causing denial of service for all platform users on versions prior to 1.8.224. The root cause is the complete absence of rate limiting on the upload route - a low-complexity, network-accessible weakness requiring no special privileges per the CVSS vector. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploitation mechanics mean any motivated user can weaponize this without tooling. | MEDIUM | 5.3 | 0.2% | 27 |
|
| CVE-2026-53594 | Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled `rap2hpoutre/laravel-log-viewer` override decrypts a user-supplied `dl` parameter and resolves its absolute path before applying the intended `storage/logs` directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets. | MEDIUM | 4.9 | 0.4% | 25 |
|
| CVE-2026-53592 | Prototype Pollution in FreeScout's client-side `getQueryParam` function allows an authenticated attacker to write arbitrary properties into `Object.prototype` via crafted URL query strings on any page loading `main.js`. An initial mitigation introduced in version 1.8.139 blocked direct top-level `__proto__` keys but failed to sanitize nested bracket-notation bypass forms such as `b[__proto__][polluted]=PWNED`, leaving all installations between 1.8.139 and 1.8.222 still exploitable. The complete fix shipped in version 1.8.223; no public exploit or active exploitation is confirmed at time of analysis. | MEDIUM | 4.6 | 0.1% | 23 |
|