Known vulnerabilities in Zammad

Vendor: Zammad
Software: Zammad
Software CPE: cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*
Total vulnerabilities: 22
Public exploits: 0
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zammad Zammad is affected by 22 known vulnerabilities: 1 critical, 2 high, 9 medium, 10 low Critical High Medium Low

Vulnerabilities (22)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153893 - Insertion of Sensitive Information Into Sent Data
CWE-201 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153892 - Exposure of Private Information ('Privacy Violation')
CWE-359 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153890 - Missing Authorization
CWE-862 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153881 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153880 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153879 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
7.2.1 07.10.2026 SB20261007227
#VU153878 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
7.2.1 07.10.2026 SB20261007227
#VU153877 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
7.2.1 07.10.2026 SB20261007227
#VU153865 - Improper Authentication
CWE-287 High
No
No
7.2.1 07.10.2026 SB20261007227
#VU153864 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
7.2.1 07.10.2026 SB20261007227
#VU153220 - Inappropriate Encoding for Output Context
CVE-2026-84463
CWE-838 Low
No
No
7.1.2 03.10.2026 SB2026100309
#VU153219 - Improper Certificate Validation
CVE-2026-84465
CWE-295 Medium
No
No
7.1.2 03.10.2026 SB2026100309
#VU153218 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367 Medium
No
No
7.1.3 03.10.2026 SB2026100308
#VU153217 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-102345
CWE-79 Low
No
No
7.1.2 03.10.2026 SB2026100309
#VU153216 - Improper Neutralization of Script in Attributes in a Web Page
CWE-83 Low
No
No
7.1.3 03.10.2026 SB2026100308
#VU153215 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
7.1.3 03.10.2026 SB2026100308
#VU153214 - Insufficiently Protected Credentials
CWE-522 Low
No
No
7.1.3 03.10.2026 SB2026100308
#VU153213 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
7.1.3 03.10.2026 SB2026100308
#VU153212 - Missing Authorization
CWE-862 Low
No
No
7.1.3 03.10.2026 SB2026100308
#VU153211 - Missing Authorization
CWE-862 Medium
No
No
7.1.3 03.10.2026 SB2026100308


Showing elements 1 - 20 out of 22