OTRS GmbH (former OTRS AG) OTRS

• CVE-2026-93582 Critical 9.4 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication 0.4%
• CVE-2026-93581 Medium 6.1 Insufficient Neutralization of Formula Elements in CSV Exports 0.2%
• CVE-2026-78359 Medium 5.4 Duplicate Identity / Identity Shadowing across CustomerUser backends 0.2%
• CVE-2026-78358 Medium 4.3 Cross-Site Request Forgery in Administrative Actions 0.1%
• CVE-2026-78357 Critical 9.1 Insufficient Session Revocation for JWT Authentication 0.3%
• CVE-2026-78356 Medium 5.3 Unauthenticated Disclosure of Agent Frontend Configuration 0.3%
• CVE-2026-78355 High 8.7 Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory 0.7%
• CVE-2026-48212 Medium 4.8 Stored XSS in external pages 0.1%
• CVE-2026-48211 Medium 5.4 Cross-Site Request Forgery in Import/Export Admin console 0.1%