Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40565 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs… https://www.cve.org/CVERecord?id=CVE-2026-40565
Post summary
The snippet simply announces CVE‑2026‑40565, noting its impact on FreeScout’s linkify() function, but provides no exploit, patch, or detailed technical information.
🚨*CVE* CVE-2026-40565 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs… https://www.cve.org/CVERecord?id=CVE-2026-40565 ----- Traducción: CVE-2026-40565 Fre… http://infoflow.cloud`
Post summary
The text merely mentions CVE‑2026‑40565 and links to its CVE record, offering minimal context without PoC, exploit code, evidence of active exploitation, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freescout | freescout | - | - | - |