O
Vendor security profile
otrs
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs17
Critical3
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
0
0
1
7
0
0
0
9
CVE KEV
CVE severity distribution
17toplam CVE
Critical3 (18%)
High2 (12%)
Medium10 (59%)
Low2 (12%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
17Unknown
Latest vulnerabilities
9.4
CVE-2026-93582
Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
OG
Patch status unknown
6.1
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Exports
OG
Patch status unknown
5.4
CVE-2026-78359
Duplicate Identity / Identity Shadowing across CustomerUser backends
OG
Patch status unknown
4.3
CVE-2026-78358
Cross-Site Request Forgery in Administrative Actions
OG
Patch status unknown
9.1
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication
OG
Patch status unknown
5.3
CVE-2026-78356
Unauthenticated Disclosure of Agent Frontend Configuration
OG
Patch status unknown
8.7
CVE-2026-78355
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
OG
Patch status unknown
4.8
CVE-2026-48212
Stored XSS in external pages
OG
Patch status unknown
5.4
CVE-2026-48211
Cross-Site Request Forgery in Import/Export Admin console
OG
Patch status unknown
7.1
CVE-2026-48209
Cross-site scripting in Otrs
O
Patch status unknownEPSS %0