ZA
Vendor
zammad
123
CVEs
2
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102490 In wildKEV | ZA Zammad Zammad | 7.8 | Sep 30 | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package |
| CVE-2026-102489 In wildKEV | ZA Zammad Zammad | 9.8 | Sep 30 | Undisclosed RCE in Zammad v6.3 and higher |
| CVE-2026-63208 | ZA zammad zammad | 5.1 | Sep 25 | Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens |
| CVE-2026-63006 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset |
| CVE-2026-63204 | ZA zammad zammad | 2.3 | Sep 25 | Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets |
| CVE-2026-61855 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail |
| CVE-2026-84461 | ZA zammad zammad | 6.9 | Sep 25 | Zammad: Missing rate limiting allows password brute-forcing during two-factor login |
| CVE-2026-63207 | ZA zammad zammad | 6.9 | Sep 25 | Zammad: Sensitive Information Exposure in Integration Administration API |
| CVE-2026-84465 | ZA zammad zammad | 7.1 | Sep 25 | Zammad: S/MIME signature verification allows forged sender impersonation |
| CVE-2026-84463 | ZA zammad zammad | 6.3 | Sep 25 | Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute |
| CVE-2026-84464 | ZA zammad zammad | 7.1 | Sep 25 | Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data |
| CVE-2026-63216 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Stored XSS via unescaped option labels in the object attribute options context UI |
| CVE-2026-84458 | ZA zammad zammad | 9.1 | Sep 25 | Zammad: Account takeover via unverified email matching during SSO auto-link |
| CVE-2026-84460 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration |
| CVE-2026-63206 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Remote image tracking bypass via shortened URL scheme |
| CVE-2026-63205 | ZA zammad zammad | 5.1 | Sep 25 | Zammad: Channel admins can read unauthorized attachments via signature rich-text body |
| CVE-2026-84462 | ZA zammad zammad | 8.6 | Sep 25 | Zammad: AI Agent template sanitizer bypass leads to remote code execution |
| CVE-2026-65828 | ZA zammad zammad | 2.3 | Sep 25 | Zammad: Pending upload deletion bypass via legacy attachment endpoint |
| CVE-2026-61525 | ZA zammad zammad | 8.8 | Sep 25 | Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller |
| CVE-2026-56728 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Cross-User Taskbar Item Access Control Vulnerability |
| CVE-2026-56725 | ZA zammad zammad | 8.7 | Sep 25 | Zammad: Denial of Service via OTRS Import Controller |
| CVE-2026-56732 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Malicious input in Ticket Body Enables Session Termination |
| CVE-2026-56730 | ZA zammad zammad | 2.1 | Sep 25 | Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers |
| CVE-2026-56733 | ZA zammad zammad | 8.7 | Sep 25 | Zammad: Incorrect Authorization and Improper Privilege Management |
| CVE-2026-56731 | ZA zammad zammad | 8.4 | Sep 25 | Zammad: Cross-Site Scripting in Ticket Notifications |
| CVE-2026-56735 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad |
| CVE-2026-56727 | ZA zammad zammad | 7.1 | Sep 25 | Zammad: PGP signature spoofing via unvalidated verification return |
| CVE-2026-56734 | ZA zammad zammad | 5.3 | Sep 25 | Zammad: Avatar Image URL Server-Side Request Forwarding |
| CVE-2026-56726 | ZA zammad zammad | 5.1 | Sep 25 | Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak |
| CVE-2026-56729 | ZA zammad zammad | 2.1 | Sep 25 | Zammad: Titles of knowledge base answers will be shown across all categories via the global search |
| CVE-2026-56723 | ZA zammad zammad | 7.1 | Sep 25 | Zammad: Missing authorization on ticket attachment download |
| CVE-2026-56724 | ZA zammad zammad | 7.1 | Sep 25 | Zammad: Incorrect implementation of permission checks in the knowledge base module |
| CVE-2026-13229 | ZA Zammad Zammad | 7.1 | Aug 4 | Zammad 7.0.1 - Improper authorization in ticket article attachment cloning |
| CVE-2026-34837 | ZA zammad zammad | 4.3 | Apr 8 | Zammad is miissing authorization in AI assistance controller for context data used in text tools |
| CVE-2026-34782 | ZA zammad zammad | 4.3 | Apr 8 | Zammad has improper access control in AI assistance controller for text tools |
| CVE-2026-34724 | ZA zammad zammad | 7.2 | Apr 8 | Zammad has a server-side template injection leading to RCE via AI Agent |
| CVE-2026-34723 | ZA zammad zammad | 7.5 | Apr 8 | Zammad has incorrect access control in getting_started_controller |
| CVE-2026-34722 | ZA zammad zammad | 4.3 | Apr 8 | Zammad is missing authorization in ticket create endpoint |
| CVE-2026-34721 | ZA zammad zammad | 6.5 | Apr 8 | Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints |
| CVE-2026-34720 | ZA zammad zammad | 4.3 | Apr 8 | Zammad has an origin validation error in SSO mechanism |
| CVE-2026-34719 | ZA zammad zammad | 4.3 | Apr 8 | Zammad has a Server-side request forgery (SSRF) via webhooks |
| CVE-2026-34718 | ZA zammad zammad | 6.1 | Apr 8 | Zammad improperly neutralizes of script-related HTML tags in ticket articles |
| CVE-2026-34248 | ZA zammad zammad | 5.7 | Apr 8 | Zammad has an information disclosure in ticket detail view of customers in shared organizations |
| CVE-2025-32358 | ZA Zammad Zammad | 4.1 | Apr 5 | In Zammad 6.4.x before 6.4.2, SSRF can occur |
| CVE-2025-32359 | ZA Zammad Zammad | 8.8 | Apr 5 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security |
| CVE-2025-32360 | ZA Zammad Zammad | 8.1 | Apr 5 | In Zammad 6.4.x before 6.4.2, there is information exposure |
| CVE-2025-32357 | ZA Zammad Zammad | 4.3 | Apr 5 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission… |
| CVE-2024-55578 | ZA Zammad Zammad | 4.3 | Dec 9 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files |
| CVE-2024-36078 | ZA Zammad Zammad | 6.7 | May 19 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions |
| CVE-2024-33668 | ZA Zammad Zammad | 9.1 | Apr 26 | An issue was discovered in Zammad before 6.3.0 |
| CVE-2024-33667 | ZA Zammad Zammad | 6.5 | Apr 26 | An issue was discovered in Zammad before 6.3.0 |
| CVE-2024-33666 | ZA Zammad Zammad | 8.6 | Apr 26 | An issue was discovered in Zammad before 6.3.0 |
| CVE-2023-50457 | ZA Zammad Zammad | 4.3 | Dec 10 | An issue was discovered in Zammad before 6.2.0 |
| CVE-2023-50456 | ZA Zammad Zammad | 5.3 | Dec 10 | An issue was discovered in Zammad before 6.2.0 |
| CVE-2023-50455 | ZA Zammad Zammad | 7.5 | Dec 10 | An issue was discovered in Zammad before 6.2.0 |
| CVE-2023-50454 | ZA Zammad Zammad | 5.9 | Dec 10 | An issue was discovered in Zammad before 6.2.0 |
| CVE-2023-50453 | ZA Zammad Zammad | 5.3 | Dec 10 | An issue was discovered in Zammad before 6.2.0 |
| CVE-2023-31597 | ZA Zammad Zammad | 6.5 | May 18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user |
| CVE-2023-29868 | ZA Zammad Zammad | 6.5 | May 2 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control |
| CVE-2023-29867 | ZA Zammad Zammad | 6.5 | May 2 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control |