Z
Vendor security profile2 actively exploited CVEs
zammad
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs44
Critical2
CISA KEV2
Public exploit4
Patch rate%2
Avg. CVSS6.1
12-month vulnerability rate
0
0
0
0
0
10
0
0
0
1
32
0
CVE KEV
CVE severity distribution
44toplam CVE
Critical2 (5%)
High15 (34%)
Medium23 (52%)
Low4 (9%)
Patch and exploitation view
%2
Verified patch
%5
CISA KEV
%9
Public exploit
1Patch available
0Partial
2Workaround
0Vendor: no patch
41Unknown
Latest vulnerabilities
8.5
CVE-2026-102490 Actively exploited
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
ZG
WorkaroundEPSS %1
8.7
CVE-2026-102489 Actively exploited
Undisclosed RCE in Zammad v6.3 and higher
ZG
WorkaroundEPSS %1
5.1
CVE-2026-63208
Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Z
Patch status unknownEPSS %0
5.3
CVE-2026-63006
Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
Z
Patch status unknownEPSS %0
2.3
CVE-2026-63204
Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
Z
Patch status unknownEPSS %0
5.3
CVE-2026-61855
Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
Z
Patch status unknownEPSS %0
6.9
CVE-2026-84461
Zammad: Missing rate limiting allows password brute-forcing during two-factor login
Z
Patch status unknownEPSS %0
6.9
CVE-2026-63207
Zammad: Sensitive Information Exposure in Integration Administration API
Z
Patch status unknownEPSS %0
7.1
CVE-2026-84465
Zammad: S/MIME signature verification allows forged sender impersonation
Z
Patch status unknownEPSS %0
6.3
CVE-2026-84463
Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
Z
Patch status unknownEPSS %0