CVE-2026-59994

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for Post and Mention notifications did not cover this notification path. This issue is fixed in version 9.3.9.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-599955.4sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attackerCVE-2026-599965.4scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinaCVE-2026-599975.4internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-lCVE-2026-599986.5sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in WindoCVE-2026-599997.5In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.CVE-2026-60004.3A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sqCVE-2026-600007.5sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptCVE-2026-600016.5sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-600029.4ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only CVE-2026-600049.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.CVE-2026-600058.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex capturCVE-2026-600077.4In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a
CVE-2026-59994: Medium severity, CVSS 4.3 | Vulnix