agentprime: zammad

agentprime: zammadEvery new CVE for zammad.https://agentprime.io/CVE-2026-102345: Zammad: Stored XSS in ticket article rendering in the new Vue-based interfacehttps://agentprime.io/advisories/CVE-2026-102345/https://agentprime.io/advisories/CVE-2026-102345/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:59:57 GMTCVECVE-2026-102490: Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packagehttps://agentprime.io/advisories/CVE-2026-102490/https://agentprime.io/advisories/CVE-2026-102490/CVSS 8.5 (High). Critical: In CISA’s KEV catalogue since 2 Oct 2026: it is known to be exploited. CVSS score 8.5 (7.0 or more) and EPSS 0.11 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 16:21:20 GMTCVEcriticalKEVCVE-2026-102489: Undisclosed RCE in Zammad v6.3 and higherhttps://agentprime.io/advisories/CVE-2026-102489/https://agentprime.io/advisories/CVE-2026-102489/CVSS 8.7 (High). Critical: In CISA’s KEV catalogue since 2 Oct 2026: it is known to be exploited. CVSS score 8.7 (7.0 or more) and EPSS 0.22 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 16:21:19 GMTCVEcriticalKEVCVE-2026-63208: Zammad: Microsoft Graph error logs expose partially masked OAuth access tokenshttps://agentprime.io/advisories/CVE-2026-63208/https://agentprime.io/advisories/CVE-2026-63208/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:23:47 GMTCVECVE-2026-63006: Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsethttps://agentprime.io/advisories/CVE-2026-63006/https://agentprime.io/advisories/CVE-2026-63006/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:23:13 GMTCVECVE-2026-63204: Zammad: Authenticated agents can read AI summary error messages from inaccessible ticketshttps://agentprime.io/advisories/CVE-2026-63204/https://agentprime.io/advisories/CVE-2026-63204/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:22:40 GMTCVECVE-2026-61855: Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mailhttps://agentprime.io/advisories/CVE-2026-61855/https://agentprime.io/advisories/CVE-2026-61855/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:21:55 GMTCVECVE-2026-84461: Zammad: Missing rate limiting allows password brute-forcing during two-factor loginhttps://agentprime.io/advisories/CVE-2026-84461/https://agentprime.io/advisories/CVE-2026-84461/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:21:20 GMTCVECVE-2026-63207: Zammad: Sensitive Information Exposure in Integration Administration APIhttps://agentprime.io/advisories/CVE-2026-63207/https://agentprime.io/advisories/CVE-2026-63207/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:20:44 GMTCVECVE-2026-84465: Zammad: S/MIME signature verification allows forged sender impersonationhttps://agentprime.io/advisories/CVE-2026-84465/https://agentprime.io/advisories/CVE-2026-84465/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:19:58 GMTCVECVE-2026-84463: Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributehttps://agentprime.io/advisories/CVE-2026-84463/https://agentprime.io/advisories/CVE-2026-84463/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:19:19 GMTCVECVE-2026-84464: Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization datahttps://agentprime.io/advisories/CVE-2026-84464/https://agentprime.io/advisories/CVE-2026-84464/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:18:40 GMTCVECVE-2026-63216: Zammad: Stored XSS via unescaped option labels in the object attribute options context UIhttps://agentprime.io/advisories/CVE-2026-63216/https://agentprime.io/advisories/CVE-2026-63216/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:16:01 GMTCVECVE-2026-84458: Zammad: Account takeover via unverified email matching during SSO auto-linkhttps://agentprime.io/advisories/CVE-2026-84458/https://agentprime.io/advisories/CVE-2026-84458/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:15:26 GMTCVEcriticalCVE-2026-84460: Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumerationhttps://agentprime.io/advisories/CVE-2026-84460/https://agentprime.io/advisories/CVE-2026-84460/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:14:49 GMTCVECVE-2026-63206: Zammad: Remote image tracking bypass via shortened URL schemehttps://agentprime.io/advisories/CVE-2026-63206/https://agentprime.io/advisories/CVE-2026-63206/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:14:06 GMTCVECVE-2026-63205: Zammad: Channel admins can read unauthorized attachments via signature rich-text bodyhttps://agentprime.io/advisories/CVE-2026-63205/https://agentprime.io/advisories/CVE-2026-63205/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 18:13:25 GMTCVECVE-2026-84462: Zammad: AI Agent template sanitizer bypass leads to remote code executionhttps://agentprime.io/advisories/CVE-2026-84462/https://agentprime.io/advisories/CVE-2026-84462/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:29:15 GMTCVECVE-2026-65828: Zammad: Pending upload deletion bypass via legacy attachment endpointhttps://agentprime.io/advisories/CVE-2026-65828/https://agentprime.io/advisories/CVE-2026-65828/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:28:13 GMTCVECVE-2026-61525: Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controllerhttps://agentprime.io/advisories/CVE-2026-61525/https://agentprime.io/advisories/CVE-2026-61525/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:11:33 GMTCVECVE-2026-56728: Zammad: Cross-User Taskbar Item Access Control Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-56728/https://agentprime.io/advisories/CVE-2026-56728/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:10:16 GMTCVECVE-2026-56725: Zammad: Denial of Service via OTRS Import Controllerhttps://agentprime.io/advisories/CVE-2026-56725/https://agentprime.io/advisories/CVE-2026-56725/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:09:05 GMTCVECVE-2026-56732: Zammad: Malicious input in Ticket Body Enables Session Terminationhttps://agentprime.io/advisories/CVE-2026-56732/https://agentprime.io/advisories/CVE-2026-56732/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:08:20 GMTCVECVE-2026-56730: Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answershttps://agentprime.io/advisories/CVE-2026-56730/https://agentprime.io/advisories/CVE-2026-56730/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:07:02 GMTCVECVE-2026-56733: Zammad: Incorrect Authorization and Improper Privilege Managementhttps://agentprime.io/advisories/CVE-2026-56733/https://agentprime.io/advisories/CVE-2026-56733/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:05:56 GMTCVECVE-2026-56731: Zammad: Cross-Site Scripting in Ticket Notificationshttps://agentprime.io/advisories/CVE-2026-56731/https://agentprime.io/advisories/CVE-2026-56731/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:04:50 GMTCVECVE-2026-56735: Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammadhttps://agentprime.io/advisories/CVE-2026-56735/https://agentprime.io/advisories/CVE-2026-56735/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:04:03 GMTCVECVE-2026-56727: Zammad: PGP signature spoofing via unvalidated verification returnhttps://agentprime.io/advisories/CVE-2026-56727/https://agentprime.io/advisories/CVE-2026-56727/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:02:39 GMTCVECVE-2026-56734: Zammad: Avatar Image URL Server-Side Request Forwardinghttps://agentprime.io/advisories/CVE-2026-56734/https://agentprime.io/advisories/CVE-2026-56734/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:01:46 GMTCVECVE-2026-56726: Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leakhttps://agentprime.io/advisories/CVE-2026-56726/https://agentprime.io/advisories/CVE-2026-56726/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 17:01:00 GMTCVECVE-2026-56729: Zammad: Titles of knowledge base answers will be shown across all categories via the global searchhttps://agentprime.io/advisories/CVE-2026-56729/https://agentprime.io/advisories/CVE-2026-56729/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 16:58:05 GMTCVECVE-2026-56723: Zammad: Missing authorization on ticket attachment downloadhttps://agentprime.io/advisories/CVE-2026-56723/https://agentprime.io/advisories/CVE-2026-56723/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 16:48:34 GMTCVECVE-2026-56724: Zammad: Incorrect implementation of permission checks in the knowledge base modulehttps://agentprime.io/advisories/CVE-2026-56724/https://agentprime.io/advisories/CVE-2026-56724/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 16:46:50 GMTCVECVE-2026-13229: Zammad 7.0.1 - Improper authorization in ticket article attachment cloninghttps://agentprime.io/advisories/CVE-2026-13229/https://agentprime.io/advisories/CVE-2026-13229/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Aug 2026 18:12:04 GMTCVECVE-2026-34837: Zammad is miissing authorization in AI assistance controller for context data used in text toolshttps://agentprime.io/advisories/CVE-2026-34837/https://agentprime.io/advisories/CVE-2026-34837/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:20:00 GMTCVECVE-2026-34782: Zammad has improper access control in AI assistance controller for text toolshttps://agentprime.io/advisories/CVE-2026-34782/https://agentprime.io/advisories/CVE-2026-34782/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:18:32 GMTCVECVE-2026-34724: Zammad has a server-side template injection leading to RCE via AI Agenthttps://agentprime.io/advisories/CVE-2026-34724/https://agentprime.io/advisories/CVE-2026-34724/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:17:30 GMTCVECVE-2026-34723: Zammad has incorrect access control in getting_started_controllerhttps://agentprime.io/advisories/CVE-2026-34723/https://agentprime.io/advisories/CVE-2026-34723/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:14:08 GMTCVECVE-2026-34722: Zammad is missing authorization in ticket create endpointhttps://agentprime.io/advisories/CVE-2026-34722/https://agentprime.io/advisories/CVE-2026-34722/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:13:20 GMTCVECVE-2026-34721: Zammad has Cross-site request forgery (CSRF) in OAuth callback endpointshttps://agentprime.io/advisories/CVE-2026-34721/https://agentprime.io/advisories/CVE-2026-34721/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:12:32 GMTCVECVE-2026-34720: Zammad has an origin validation error in SSO mechanismhttps://agentprime.io/advisories/CVE-2026-34720/https://agentprime.io/advisories/CVE-2026-34720/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:11:23 GMTCVECVE-2026-34719: Zammad has a Server-side request forgery (SSRF) via webhookshttps://agentprime.io/advisories/CVE-2026-34719/https://agentprime.io/advisories/CVE-2026-34719/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:02:16 GMTCVECVE-2026-34718: Zammad improperly neutralizes of script-related HTML tags in ticket articleshttps://agentprime.io/advisories/CVE-2026-34718/https://agentprime.io/advisories/CVE-2026-34718/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:01:20 GMTCVECVE-2026-34248: Zammad has an information disclosure in ticket detail view of customers in shared organizationshttps://agentprime.io/advisories/CVE-2026-34248/https://agentprime.io/advisories/CVE-2026-34248/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 18:00:09 GMTCVECVE-2025-32360: In Zammad 6.4.x before 6.4.2, there is information exposure.https://agentprime.io/advisories/CVE-2025-32360/https://agentprime.io/advisories/CVE-2025-32360/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Apr 2025 00:00:00 GMTCVECVE-2025-32359: In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.https://agentprime.io/advisories/CVE-2025-32359/https://agentprime.io/advisories/CVE-2025-32359/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Apr 2025 00:00:00 GMTCVECVE-2025-32358: Server-side request forgery in Zammadhttps://agentprime.io/advisories/CVE-2025-32358/https://agentprime.io/advisories/CVE-2025-32358/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Apr 2025 00:00:00 GMTCVECVE-2025-32357: Authentication bypass in Zammadhttps://agentprime.io/advisories/CVE-2025-32357/https://agentprime.io/advisories/CVE-2025-32357/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Apr 2025 00:00:00 GMTCVECVE-2019-1010018: Cross-site scripting in Zammadhttps://agentprime.io/advisories/CVE-2019-1010018/https://agentprime.io/advisories/CVE-2019-1010018/Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Jul 2019 12:35:14 GMTCVE