Login Request a demo
PF
Product
Prospero Flow CRM
by Roskus · last CVE Oct 22, 2026
20
CVEs
0
On KEV
9.3
Max CVSS
1
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 2High 9Medium 9Low 0
Severity
All severities20Critical2High9Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Prospero Flow CRM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-59240
6.9
0%
Jul 27
IDOR in Prospero Flow CRM allows deletion of other users' notifications
Affected: 1.0.0 before 5.5.1
CVE-2026-59237
6.9
1%
Jul 16
IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
Affected: 4.6.0 before 5.5.3
CVE-2026-59236
6.9
1%
Jul 15
Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Affected: 1.0.0 before 5.14.0
CVE-2026-59234
6.9
1%
Jul 3
Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion
Affected: 1.0.0 before 5.5.3
CVE-2026-77780
5.3
0%
Aug 21
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
Affected: 4.9.1 before 5.14.2
CVE-2026-59232
5.3
1%
Jul 31
Stored Cross-site Scripting in Prospero Flow CRM lead name field
Affected: before 5.3.7
CVE-2026-82911
5.1
0%
Sep 4
CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
Affected: before 5.15.11
CVE-2026-81931
4.8
0%
Aug 27
Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
Affected: before 5.16.0
CVE-2026-78337
4.8
0%
Aug 24
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
Affected: before 5.15.13
Showing 9