Zammad vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202642

Newest CVEs

• CVE-2026-102345

  Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

  zammad · zammad

  Medium5.1
• CVE-2026-63208

  Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

  zammad · zammad

  Medium5.1
• CVE-2026-63006

  Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

  zammad · zammad

  Medium5.3
• CVE-2026-63204

  Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

  zammad · zammad

  Low2.3
• CVE-2026-61855

  Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

  zammad · zammad

  Medium5.3
• CVE-2026-84461

  Zammad: Missing rate limiting allows password brute-forcing during two-factor login

  zammad · zammad

  Medium6.9
• CVE-2026-63207

  Zammad: Sensitive Information Exposure in Integration Administration API

  zammad · zammad

  Medium6.9
• CVE-2026-84465

  Zammad: S/MIME signature verification allows forged sender impersonation

  zammad · zammad

  High7.1
• CVE-2026-84463

  Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

  zammad · zammad

  Medium6.3
• CVE-2026-84464

  Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

  zammad · zammad

  High7.1