https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33289.htmlhttps://patchthecve.com/cve/CVE-2026-33289.htmlWed, 17 Jun 2026 10:37:15 +0000HIGH 8.8: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding ithttps://patchthecve.com/cve/CVE-2026-33288.htmlhttps://patchthecve.com/cve/CVE-2026-33288.htmlWed, 17 Jun 2026 10:37:15 +0000HIGH 8.8: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection vulnerability exists in the SuiteCRM authentication mechanisms when directory support is enabled. The application fails to properly sanitize thttps://patchthecve.com/cve/CVE-2026-32697.htmlhttps://patchthecve.com/cve/CVE-2026-32697.htmlWed, 17 Jun 2026 10:36:13 +0000MEDIUM 6.5: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user's ACL view permission. The companion `saveRecord()` methohttps://patchthecve.com/cve/CVE-2026-29189.htmlhttps://patchthecve.com/cve/CVE-2026-29189.htmlWed, 17 Jun 2026 10:29:44 +0000HIGH 8.1: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they shhttps://patchthecve.com/cve/CVE-2026-29109.htmlhttps://patchthecve.com/cve/CVE-2026-29109.htmlWed, 17 Jun 2026 10:29:36 +0000HIGH 7.2: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary https://patchthecve.com/cve/CVE-2026-29108.htmlhttps://patchthecve.com/cve/CVE-2026-29108.htmlWed, 17 Jun 2026 10:29:36 +0000MEDIUM 6.5: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As ahttps://patchthecve.com/cve/CVE-2026-29107.htmlhttps://patchthecve.com/cve/CVE-2026-29107.htmlWed, 17 Jun 2026 10:29:36 +0000MEDIUM 5.0: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with `<img>` tags. When a PDF is exported using this template, the content (for example, `<img src=http://{burp_collabohttps://patchthecve.com/cve/CVE-2026-29106.htmlhttps://patchthecve.com/cve/CVE-2026-29106.htmlWed, 17 Jun 2026 10:29:36 +0000MEDIUM 5.9: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return_id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double quotatihttps://patchthecve.com/cve/CVE-2026-29105.htmlhttps://patchthecve.com/cve/CVE-2026-29105.htmlWed, 17 Jun 2026 10:29:36 +0000MEDIUM 5.4: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect https://patchthecve.com/cve/CVE-2026-29104.htmlhttps://patchthecve.com/cve/CVE-2026-29104.htmlWed, 17 Jun 2026 10:29:36 +0000LOW 2.7: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an authenticated arbitrary file upload vulnerability in the Configurator module. An authenticated administrator can bypass intended file typhttps://patchthecve.com/cve/CVE-2026-29103.htmlhttps://patchthecve.com/cve/CVE-2026-29103.htmlWed, 17 Jun 2026 10:29:36 +0000CRITICAL 9.1: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direhttps://patchthecve.com/cve/CVE-2026-29102.htmlhttps://patchthecve.com/cve/CVE-2026-29102.htmlWed, 17 Jun 2026 10:29:36 +0000HIGH 7.2: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.https://patchthecve.com/cve/CVE-2026-29101.htmlhttps://patchthecve.com/cve/CVE-2026-29101.htmlWed, 17 Jun 2026 10:29:35 +0000MEDIUM 4.9: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Service (DoS) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.https://patchthecve.com/cve/CVE-2026-29100.htmlhttps://patchthecve.com/cve/CVE-2026-29100.htmlWed, 17 Jun 2026 10:29:35 +0000HIGH 7.1: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Versionhttps://patchthecve.com/cve/CVE-2026-29099.htmlhttps://patchthecve.com/cve/CVE-2026-29099.htmlWed, 17 Jun 2026 10:29:35 +0000HIGH 8.8: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` fails to properly neutralize the user controlled `$id` parameter. It is assumed that thhttps://patchthecve.com/cve/CVE-2026-29098.htmlhttps://patchthecve.com/cve/CVE-2026-29098.htmlWed, 17 Jun 2026 10:29:35 +0000MEDIUM 4.9: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_exportCustom` function in `modules/ModuleBuilder/controller.php` fails to properly neutralize path traversal sequences in the `$modules` and `$namhttps://patchthecve.com/cve/CVE-2026-29097.htmlhttps://patchthecve.com/cve/CVE-2026-29097.htmlWed, 17 Jun 2026 10:29:35 +0000HIGH 7.5: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. Versions 7.15.1https://patchthecve.com/cve/CVE-2026-29096.htmlhttps://patchthecve.com/cve/CVE-2026-29096.htmlWed, 17 Jun 2026 10:29:35 +0000HIGH 8.1: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the `field_function` parameter from POST data is saved directly into the `aor_fields` table without an