OG
Vendor
OTRS GmbH (former OTRS AG)
14
CVEs
0
On KEV
14
New 30D
Products
OT9.1
OTRS
OTRS GmbH (former OTRS AG)
8 CVEs0 on KEV8 new
OC9.4
((OTRS)) Community Edition
OTRS GmbH (former OTRS AG)
6 CVEs0 on KEV6 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-93582 | OC ((OTRS)) Community Edition OTRS GmbH (former OTRS AG) | 9.4 | Oct 12 | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication |
| CVE-2026-93581 | OT OTRS OTRS GmbH (former OTRS AG) | 6.1 | Oct 12 | Insufficient Neutralization of Formula Elements in CSV Exports |
| CVE-2026-78359 | OT OTRS OTRS GmbH (former OTRS AG) | 5.4 | Oct 12 | Duplicate Identity / Identity Shadowing across CustomerUser backends |
| CVE-2026-78358 | OT OTRS OTRS GmbH (former OTRS AG) | 4.3 | Oct 12 | Cross-Site Request Forgery in Administrative Actions |
| CVE-2026-78357 | OT OTRS OTRS GmbH (former OTRS AG) | 9.1 | Oct 12 | Insufficient Session Revocation for JWT Authentication |
| CVE-2026-78356 | OT OTRS OTRS GmbH (former OTRS AG) | 5.3 | Oct 12 | Unauthenticated Disclosure of Agent Frontend Configuration |
| CVE-2026-78355 | OT OTRS OTRS GmbH (former OTRS AG) | 8.7 | Oct 12 | Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory |
| CVE-2026-48212 | OT OTRS OTRS GmbH (former OTRS AG) | 4.8 | Oct 12 | Stored XSS in external pages |
| CVE-2026-48211 | OT OTRS OTRS GmbH (former OTRS AG) | 5.4 | Oct 12 | Cross-Site Request Forgery in Import/Export Admin console |