Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

124 records

Vendor: Zammad GmbH Clear all filters
TI-2026-65406 CVE-2026-102490 · GHSA-hgff-g8g3-4xr8

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Priority CRITICAL 100KEV

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the…

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.10936 Published 2026-09-30 Fixed in 7.2.2 CWE-269
TI-2026-65405 CVE-2026-102489 · GHSA-xmw5-m2wg-4243

Undisclosed RCE in Zammad v6.3 and higher

Priority CRITICAL 100KEV

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.49915 Published 2026-09-30 Fixed in 6.5.4 CWE-384
TI-2026-58047 CVE-2026-84463

Cross-site request forgery in zammad

Priority LOW 27

Zammad is a web based open source helpdesk/customer support system.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.0015 Published 2026-09-25 Fixed in 7.1.2 CWE-352
Load more