Information Disclosure

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains p…CVE-2020-10096Zammad · 1.1% likely

   CWE-200

2. Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.CVE-2021-35299Zammad · 1.1% likely

   CWE-532

3. An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.CVE-2021-42089Zammad · 1.1% likely

   CWE-200

4. An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information co…CVE-2020-10097Zammad · 0.9% likely

   CWE-209

5. An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain una…CVE-2020-10104Zammad · 0.8% likely

   CWE-200

6. An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the…CVE-2020-10102Zammad · 0.7% likely

   CWE-203

7. Zammad: Titles of knowledge base answers will be shown across all categories via the global searchCVE-2026-56729zammad · CVSS 2.1 · 0.4% likely

   CWE-200

8. Zammad: Cross-User Taskbar Item Access Control VulnerabilityCVE-2026-56728zammad · CVSS 5.3 · 0.3% likely

   CWE-200

9. Zammad: Missing rate limiting allows password brute-forcing during two-factor loginCVE-2026-84461zammad · CVSS 6.9 · 0.3% likely

   CWE-203

10. Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.CVE-2024-55578Zammad · CVSS 4.3 · 0.3% likely

    CWE-532

11. Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization dataCVE-2026-84464zammad · CVSS 7.1 · 0.3% likely

    CWE-200

12. Zammad: Sensitive Information Exposure in Integration Administration APICVE-2026-63207zammad · CVSS 6.9 · 0.2% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.