Vulnerabilidades en zammad
46 resultadosCVE-2026-63006MEDIUMZammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetEPSS 0.5%CVE-2026-34723HIGHZammad has incorrect access control in getting_started_controllerEPSS 0.5%CVE-2026-13229HIGHZammad 7.0.1 - Improper authorization in ticket article attachment cloningEPSS 0.4%CVE-2026-56735MEDIUMZammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadEPSS 0.4%CVE-2026-56725HIGHZammad: Denial of Service via OTRS Import ControllerEPSS 0.4%CVE-2026-56734MEDIUMZammad: Avatar Image URL Server-Side Request ForwardingEPSS 0.4%CVE-2026-56729LOWZammad: Titles of knowledge base answers will be shown across all categories via the global searchEPSS 0.4%CVE-2026-61525HIGHZammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling ControllerEPSS 0.4%CVE-2026-84458CRITICALZammad: Account takeover via unverified email matching during SSO auto-linkEPSS 0.4%CVE-2026-56730LOWZammad: Missing authorization in GraphQL mutation for suggesting knowledge base answersEPSS 0.4%CVE-2026-56726MEDIUMZammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leakEPSS 0.3%CVE-2026-56728MEDIUMZammad: Cross-User Taskbar Item Access Control VulnerabilityEPSS 0.3%CVE-2026-84461MEDIUMZammad: Missing rate limiting allows password brute-forcing during two-factor loginEPSS 0.3%CVE-2026-63205MEDIUMZammad: Channel admins can read unauthorized attachments via signature rich-text bodyEPSS 0.3%CVE-2026-34724HIGHZammad has a server-side template injection leading to RCE via AI AgentEPSS 0.3%CVE-2026-63208MEDIUMZammad: Microsoft Graph error logs expose partially masked OAuth access tokensEPSS 0.3%CVE-2025-32359MEDIUMIn Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configEPSS 0.3%CVE-2026-84464HIGHZammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization dataEPSS 0.3%CVE-2026-63204LOWZammad: Authenticated agents can read AI summary error messages from inaccessible ticketsEPSS 0.3%CVE-2026-63206MEDIUMZammad: Remote image tracking bypass via shortened URL schemeEPSS 0.3%