CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
2 advisories matched
2026-09-30
Zammad DEB/RPM Package Local Privilege Escalation Advisory (CVE-2026-102490)
[Affected Scope] Zammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).
[Impact] A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.
[Mitigation] Immediately update Zammad to the latest patched version via package manager.
2026-09-30
Zammad Session Hijack to Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-102489)
[Affected Scope] Zammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)
[Impact] Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.
[Mitigation] Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).