https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33733.htmlhttps://patchthecve.com/cve/CVE-2026-33733.htmlWed, 17 Jun 2026 10:38:00 +0000HIGH 7.2: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authttps://patchthecve.com/cve/CVE-2026-33656.htmlhttps://patchthecve.com/cve/CVE-2026-33656.htmlWed, 17 Jun 2026 10:37:52 +0000CRITICAL 9.1: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is chttps://patchthecve.com/cve/CVE-2026-33740.htmlhttps://patchthecve.com/cve/CVE-2026-33740.htmlWed, 17 Jun 2026 10:38:01 +0000MEDIUM 5.4: EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from https://patchthecve.com/cve/CVE-2026-33659.htmlhttps://patchthecve.com/cve/CVE-2026-33659.htmlWed, 17 Jun 2026 10:37:52 +0000LOW 3.5: EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulnerable to Server-Side Request Forgery (SSRF) via a DNS rebinding (TOCTOU) condition. Host validation uses dns_get_record() but the actual HTTPhttps://patchthecve.com/cve/CVE-2026-33657.htmlhttps://patchthecve.com/cve/CVE-2026-33657.htmlWed, 17 Jun 2026 10:37:52 +0000MEDIUM 4.6: EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-generated email notifications by crafting https://patchthecve.com/cve/CVE-2026-33534.htmlhttps://patchthecve.com/cve/CVE-2026-33534.htmlWed, 17 Jun 2026 10:37:40 +0000MEDIUM 4.3: EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 017