CVE Tools
Track your stack

Suitecrm

128 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Suitecrm, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Suitecrm CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Suitecrm CVEs per month
MonthCVEs
2024-116
2024-120
2025-012
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-086
2025-090
2025-101
2025-118
2025-120
2026-010
2026-020
2026-0318
2026-042
2026-050
2026-060
2026-070
2026-080
2026-090
2026-102

Severity

How the 128 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2721%
  • High5039%
  • Medium4737%
  • Low43%

Latest CVEs

The 15 most recently published vulnerabilities affecting Suitecrm.

  1. CVE-2026-108712SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point4.3
  2. CVE-2026-108713SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate4.3
  3. CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter7.1
  4. CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter7.1
  5. CVE-2026-32697SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)6.5
  6. CVE-2026-29109SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing7.2
  7. CVE-2026-29108Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User6.5
  8. CVE-2026-33289SuiterCRM has LDAP Filter Injection in Authentication Module8.8
  9. CVE-2026-33288SuiteCRM has Authenticated SQL Injection in Authentication Module8.8
  10. CVE-2026-29189SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints8.1
  11. CVE-2026-29107SuiteCRM vulnerable to authenticated SSRF via PDF export5.0
  12. CVE-2026-29106SuiteCRM has blind XSS in return_id parameter5.9
  13. CVE-2026-29105SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture5.4
  14. CVE-2026-29104SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM2.7
  15. CVE-2026-29103SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass9.1

Product grouping is registry-driven, with AI assist and human review. How it works