[ Vendor · 30 CVEs ]
zammad
CVEs affecting zammad published in the last 30 days, plus any zammad CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-84465 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming… | |
| CVE-2026-84458 | 25 Sep 2026 | CVSS 9.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is… | |
| CVE-2026-84460 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a… | |
| CVE-2026-84461 | 25 Sep 2026 | CVSS 6.9 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password… | |
| CVE-2026-84463 | 25 Sep 2026 | CVSS 6.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can… | |
| CVE-2026-84464 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records… | |
| CVE-2026-63207 | 25 Sep 2026 | CVSS 6.9 | zammadZammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration… | |
| CVE-2026-63208 | 25 Sep 2026 | CVSS 5.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error… | |
| CVE-2026-63216 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration… | |
| CVE-2026-63006 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could… | |
| CVE-2026-63204 | 25 Sep 2026 | CVSS 2.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an… | |
| CVE-2026-63205 | 25 Sep 2026 | CVSS 5.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes… | |
| CVE-2026-63206 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket… | |
| CVE-2026-61855 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound… | |
| CVE-2026-84462 | 25 Sep 2026 | CVSS 8.6 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration… | |
| CVE-2026-61525 | 25 Sep 2026 | CVSS 8.8 | zammadZammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling… | |
| CVE-2026-65828 | 25 Sep 2026 | CVSS 2.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes… | |
| CVE-2026-56735 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks… | |
| CVE-2026-56730 | 25 Sep 2026 | CVSS 2.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an… | |
| CVE-2026-56731 | 25 Sep 2026 | CVSS 8.4 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML… | |
| CVE-2026-56732 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of… | |
| CVE-2026-56733 | 25 Sep 2026 | CVSS 8.7 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation… | |
| CVE-2026-56734 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile… | |
| CVE-2026-56725 | 25 Sep 2026 | CVSS 8.7 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST… | |
| CVE-2026-56726 | 25 Sep 2026 | CVSS 5.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries… | |
| CVE-2026-56727 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return… | |
| CVE-2026-56728 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL… | |
| CVE-2026-56723 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket… | |
| CVE-2026-56724 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base… | |
| CVE-2026-56729 | 25 Sep 2026 | CVSS 2.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned… |