https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40565.htmlhttps://patchthecve.com/cve/CVE-2026-40565.htmlWed, 17 Jun 2026 10:45:27 +0000MEDIUM 6.1: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleahttps://patchthecve.com/cve/CVE-2026-40498.htmlhttps://patchthecve.com/cve/CVE-2026-40498.htmlWed, 17 Jun 2026 10:45:23 +0000CRITICAL 9.8: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in https://patchthecve.com/cve/CVE-2026-40497.htmlhttps://patchthecve.com/cve/CVE-2026-40497.htmlWed, 17 Jun 2026 10:45:23 +0000HIGH 8.1: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::stripDangerousTags()` removes `<script>`, `<form>`, `<iframe>`, `<object>` but does NOT strip `<style>` tags. The mailbox signature field is saved via POST /mailbox/settings/{id} and later rehttps://patchthecve.com/cve/CVE-2026-40496.htmlhttps://patchthecve.com/cve/CVE-2026-40496.htmlWed, 17 Jun 2026 10:45:22 +0000CRITICAL 9.1: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`. Since attachment_id is sequential and size can be brute-forced in a small range, an unauthentihttps://patchthecve.com/cve/CVE-2026-39384.htmlhttps://patchthecve.com/cve/CVE-2026-39384.htmlWed, 17 Jun 2026 10:42:01 +0000HIGH 7.6: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.https://patchthecve.com/cve/CVE-2026-35584.htmlhttps://patchthecve.com/cve/CVE-2026-35584.htmlWed, 17 Jun 2026 10:40:49 +0000MEDIUM 6.5: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unahttps://patchthecve.com/cve/CVE-2026-32754.htmlhttps://patchthecve.com/cve/CVE-2026-32754.htmlWed, 17 Jun 2026 10:36:19 +0000CRITICAL 9.3: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered uneschttps://patchthecve.com/cve/CVE-2026-32753.htmlhttps://patchthecve.com/cve/CVE-2026-32753.htmlWed, 17 Jun 2026 10:36:19 +0000MEDIUM 5.4: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of .png with content type of image/svg+xhttps://patchthecve.com/cve/CVE-2026-32752.htmlhttps://patchthecve.com/cve/CVE-2026-32752.htmlWed, 17 Jun 2026 10:36:19 +0000NONE 0.0: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-c