krayin has 15 CVEs on record. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 12. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (7) and CWE-639 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 15 prev 0
Worst active — by depth score
CVE-2026-90944High· 8.2Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox57CVE-2026-100885High· 7.3A vulnerability was found in Krayin laravel-crm up to 2.2.452CVE-2026-100883Medium· 6.3A flaw has been found in Krayin laravel-crm up to 2.2.547CVE-2026-97895Medium· 6.3A vulnerability was determined in krayin laravel-crm up to 2.2.547CVE-2026-48543Medium· 5.4Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web fo…42
krayin vulnerabilities
CVEs affecting krayin, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-112287High· 7.1Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attack…
CVE-2026-112288Low· 3.3Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isS…
CVE-2026-112286Medium· 6.5Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can que…
CVE-2026-100883Medium· 6.3PoCA flaw has been found in Krayin laravel-crm up to 2.2.5
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be l…
CVE-2026-100885High· 7.3PoCA vulnerability was found in Krayin laravel-crm up to 2.2.4
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation res…
CVE-2026-100884Medium· 4.3PoCA vulnerability has been found in Krayin laravel-crm up to 2.2.5
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation…
CVE-2026-100882Low· 2.4PoCA vulnerability was detected in Krayin laravel-crm up to 2.2.5
A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing…
CVE-2026-97896Low· 3.5PoCA vulnerability was identified in krayin laravel-crm up to 2.2.5
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Function…
CVE-2026-97895Medium· 6.3PoCA vulnerability was determined in krayin laravel-crm up to 2.2.5
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation …
CVE-2026-97897Low· 3.5PoCA security flaw has been discovered in Krayin laravel-crm up to 2.2.5
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The atta…
CVE-2026-48542Medium· 5.4PoCKrayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the produc…
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the produc…
CVE-2026-48543Medium· 5.4PoCKrayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web fo…
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web fo…
CVE-2026-48541Medium· 5.4Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person…
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person…
CVE-2026-48540Medium· 5.4PoCKrayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead t…
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead t…
CVE-2026-90944High· 8.2PoCKrayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with fo…