Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 475Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 14 | 21 | 6 | 0 | 42 | 46 |
| 2025 | 0 | 0 | 4 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-102345 | Zammad: Stored XSS in ticket article rendering in the new Vue-based interfacezammad · zammad | Medium5.1 |
| CVE-2026-63208 | Zammad: Microsoft Graph error logs expose partially masked OAuth access tokenszammad · zammad | Medium5.1 |
| CVE-2026-63006 | Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetzammad · zammad | Medium5.3 |
| CVE-2026-63204 | Zammad: Authenticated agents can read AI summary error messages from inaccessible ticketszammad · zammad | Low2.3 |
| CVE-2026-61855 | Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mailzammad · zammad | Medium5.3 |
| CVE-2026-84461 | Zammad: Missing rate limiting allows password brute-forcing during two-factor loginzammad · zammad | Medium6.9 |
| CVE-2026-63207 | Zammad: Sensitive Information Exposure in Integration Administration APIzammad · zammad | Medium6.9 |
| CVE-2026-84465 | Zammad: S/MIME signature verification allows forged sender impersonationzammad · zammad | High7.1 |
| CVE-2026-84463 | Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributezammad · zammad | Medium6.3 |
| CVE-2026-84464 | Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization datazammad · zammad | High7.1 |
| CVE-2026-63216 | Zammad: Stored XSS via unescaped option labels in the object attribute options context UIzammad · zammad | Medium5.3 |
| CVE-2026-84458 | Zammad: Account takeover via unverified email matching during SSO auto-linkzammad · zammad | Critical9.1 |
| CVE-2026-84460 | Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumerationzammad · zammad | Medium5.3 |
| CVE-2026-63206 | Zammad: Remote image tracking bypass via shortened URL schemezammad · zammad | Medium5.3 |
| CVE-2026-63205 | Zammad: Channel admins can read unauthorized attachments via signature rich-text bodyzammad · zammad | Medium5.1 |
| CVE-2026-84462 | Zammad: AI Agent template sanitizer bypass leads to remote code executionzammad · zammad | High8.6 |
| CVE-2026-65828 | Zammad: Pending upload deletion bypass via legacy attachment endpointzammad · zammad | Low2.3 |
| CVE-2026-61525 | Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controllerzammad · zammad | High8.8 |
| CVE-2026-56728 | Zammad: Cross-User Taskbar Item Access Control Vulnerabilityzammad · zammad | Medium5.3 |
| CVE-2026-56725 | Zammad: Denial of Service via OTRS Import Controllerzammad · zammad | High8.7 |
| CVE-2026-56732 | Zammad: Malicious input in Ticket Body Enables Session Terminationzammad · zammad | Medium5.3 |
| CVE-2026-56730 | Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answerszammad · zammad | Low2.1 |
| CVE-2026-56733 | Zammad: Incorrect Authorization and Improper Privilege Managementzammad · zammad | High8.7 |
| CVE-2026-56731 | Zammad: Cross-Site Scripting in Ticket Notificationszammad · zammad | High8.4 |
| CVE-2026-56735 | Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammadzammad · zammad | Medium5.3 |
| CVE-2026-56727 | Zammad: PGP signature spoofing via unvalidated verification returnzammad · zammad | High7.1 |
| CVE-2026-56734 | Zammad: Avatar Image URL Server-Side Request Forwardingzammad · zammad | Medium5.3 |
| CVE-2026-56726 | Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leakzammad · zammad | Medium5.1 |
| CVE-2026-56729 | Zammad: Titles of knowledge base answers will be shown across all categories via the global searchzammad · zammad | Low2.1 |
| CVE-2026-56723 | Zammad: Missing authorization on ticket attachment downloadzammad · zammad | High7.1 |
| CVE-2026-56724 | Zammad: Incorrect implementation of permission checks in the knowledge base modulezammad · zammad | High7.1 |
| CVE-2026-13229 | Zammad 7.0.1 - Improper authorization in ticket article attachment cloningZammad · Zammad | High7.1 |
| CVE-2026-34837 | Zammad is miissing authorization in AI assistance controller for context data used in text toolszammad · zammad | Medium5.3 |
| CVE-2026-34782 | Zammad has improper access control in AI assistance controller for text toolszammad · zammad | Medium5.3 |
| CVE-2026-34724 | Zammad has a server-side template injection leading to RCE via AI Agentzammad · zammad | High8.7 |
| CVE-2026-34723 | Zammad has incorrect access control in getting_started_controllerzammad · zammad | High8.7 |
| CVE-2026-34722 | Zammad is missing authorization in ticket create endpointzammad · zammad | Medium6.9 |
| CVE-2026-34721 | Zammad has Cross-site request forgery (CSRF) in OAuth callback endpointszammad · zammad | Medium5.9 |
| CVE-2026-34720 | Zammad has an origin validation error in SSO mechanismzammad · zammad | Low2.3 |
| CVE-2026-34719 | Zammad has a Server-side request forgery (SSRF) via webhookszammad · zammad | High8.3 |
| CVE-2026-34718 | Zammad improperly neutralizes of script-related HTML tags in ticket articleszammad · zammad | Medium5.3 |
| CVE-2026-34248 | Zammad has an information disclosure in ticket detail view of customers in shared organizationszammad · zammad | Low2.1 |
| CVE-2025-32360 | In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer…Zammad · Zammad | Medium4.2 |
| CVE-2025-32359 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need…Zammad · Zammad | Medium4.8 |
| CVE-2025-32358 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain…Zammad · Zammad | Medium4.0 |
| CVE-2025-32357 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they…Zammad · Zammad | Medium4.3 |