How many CVEs have a located fix in freescout-help-desk/freescout?

42 published CVEs have a fix traced to functions in freescout-help-desk/freescout, touching 60 functions across 34 files.

Which function in freescout-help-desk/freescout has been patched by the most CVEs?

ajax in app/Http/Controllers/ConversationsController.php has been changed by 5 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in freescout-help-desk/freescout?

The median fix changes 12 lines. 71% of fixes change 20 lines or fewer, and 48% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#98 of 500 repositories

freescout-help-desk/freescout

Name: freescout-help-desk/freescout: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 8, 2026

42

CVE fixes located

Published CVEs

60

Functions patched

Distinct function sites

34

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

42 published CVEs have a fix traced to functions in freescout-help-desk/freescout, the earliest published in 2025. Those fixes changed 60 distinct functions across 34 files, in 212 patch hunks.

Among the 500 repositories tracked here, freescout-help-desk/freescout ranks #98 by the number of CVEs with a located fix.

Most patched functions

Functions in freescout-help-desk/freescout changed by the most CVE fixes.

Most patched files

Files in freescout-help-desk/freescout changed by the most CVE fixes.

1app/Misc/Helper.php12 CVEs · 12 functions
2app/Http/Controllers/ConversationsController.php8 CVEs · 7 functions
3app/Http/Controllers/MailboxesController.php5 CVEs · 6 functions
4app/Http/Controllers/CustomersController.php4 CVEs · 4 functions
5app/Http/Controllers/UsersController.php3 CVEs · 2 functions
6app/Attachment.php2 CVEs · 3 functions
7app/Policies/ThreadPolicy.php2 CVEs · 2 functions
8app/User.php2 CVEs · 2 functions
9app/Http/Controllers/OpenController.php2 CVEs · 1 functions
10app/Http/Kernel.php2 CVEs · 1 functions

Fix size

How much code a CVE fix in freescout-help-desk/freescout changes, with backports counted once.

12

Median lines changed

Added plus removed, per CVE

71%

Fixes of 20 lines or fewer

Share of CVE fixes

48%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in freescout-help-desk/freescout, and the functions each fix changed.

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
CVE-2026-107393handle config
Medium · CVSS 6.1
EPSS 0.2%2026-10-08
FreeScout Allows Unauthenticated Access to Legacy Attachment Files
CVE-2026-48812downloadAttachment Attachment
High · CVSS 7.5
EPSS 0.6%2026-07-20
FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path
CVE-2026-47123processMessage handle
High · CVSS 7.5
EPSS 0.2%2026-05-29
FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable
CVE-2026-41194oauthDisconnect
Medium · CVSS 5.4
EPSS 0.2%2026-04-21
FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE
CVE-2026-41193extractOneFileInternal
Critical · CVSS 9.1
EPSS 0.6%2026-04-21
FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments
CVE-2026-41192processReplyAttachments ajax
High · CVSS 7.1
EPSS 0.4%2026-04-21
FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes
CVE-2026-41191updateSave
High · CVSS 7.1
EPSS 0.3%2026-04-21
FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection
CVE-2026-41190ajax
High · CVSS 7.1
EPSS 0.3%2026-04-21
FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads
CVE-2026-41189checkIsOnlyAssigned in_array
High · CVSS 7.1
EPSS 0.3%2026-04-21
FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations
CVE-2026-41183searchQuery search
Medium · CVSS 4.3
EPSS 0.4%2026-04-21
FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply
CVE-2026-40592undoReply
Medium · CVSS 5.9
EPSS 0.4%2026-04-21
FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification
CVE-2026-40591processPhoneCustomer ajax
High · CVSS 7.1
EPSS 0.3%2026-04-21

Get an alert for each new freescout-help-desk/freescout CVE, with the patched functions and AI-written analysis.

Monitor freescout CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

aio-libs/aiohttp42 CVEs directus/directus42 CVEs getgrav/grav42 CVEs openstack/nova42 CVEs argoproj/argo-cd43 CVEs coollabsio/coolify43 CVEs grafana/grafana43 CVEs LimeSurvey/LimeSurvey43 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in freescout-help-desk/freescout.

How many CVEs have a located fix in freescout-help-desk/freescout?: 42 published CVEs have a fix traced to functions in freescout-help-desk/freescout, touching 60 functions across 34 files.
Which function in freescout-help-desk/freescout has been patched by the most CVEs?: ajax in app/Http/Controllers/ConversationsController.php has been changed by 5 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in freescout-help-desk/freescout?: The median fix changes 12 lines. 71% of fixes change 20 lines or fewer, and 48% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track freescout-help-desk/freescout CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing