CVE Tools
Track your stack

Suitecrm

32 CVEs tracked since 2025. Since Aug 2025, none of them reached CISA KEV.

Suitecrm CVEs per month

Aug 2025 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Suitecrm CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-0860
2025-094 or fewer
2025-104 or fewer
2025-1180
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-03180
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Suitecrm's monthly top three, with their CVEs summed over those months.

  1. Suitecrm293 months
  2. Suitecrm-core63 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Suitecrm.

  1. CVE-2026-108712SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point4.3
  2. CVE-2026-108713SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate4.3
  3. CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter7.1
  4. CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter7.1
  5. CVE-2026-32697SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)6.5
  6. CVE-2026-29109SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing7.2
  7. CVE-2026-29108Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User6.5
  8. CVE-2026-33289SuiterCRM has LDAP Filter Injection in Authentication Module8.8
  9. CVE-2026-33288SuiteCRM has Authenticated SQL Injection in Authentication Module8.8
  10. CVE-2026-29189SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints8.1
  11. CVE-2026-29107SuiteCRM vulnerable to authenticated SSRF via PDF export5.0
  12. CVE-2026-29106SuiteCRM has blind XSS in return_id parameter5.9
  13. CVE-2026-29105SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture5.4
  14. CVE-2026-29104SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM2.7
  15. CVE-2026-29103SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass9.1

The record

Peak rank
#66 in Mar 2026
Busiest month shown
Mar 2026, 18 CVEs
Months with a KEV entry
0 since Aug 2025
Monthly snapshots
3 since 2025
Suitecrm's full record, month by month