CVE-2026-107393

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.

• CWE-79
• CWE-116

• https://github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.235
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107388music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107389music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-10739Cato Networks SDP Client for Windows before 6.12.6 allows a …8.5
• CVE-2026-107390music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107391music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107394Indico is an event management system that uses Flask-Multipa…6.8
• CVE-2026-107395Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-107396Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-107397Indico is an event management system that uses Flask-Multipa…4.4
• CVE-2026-107399The Mechanize library is used for automating interaction wit…6.8
• CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2