https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:08:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-376420 EUVD-2026-376420 https://cve.radiocsirt.org/vuln/euvd-2026-376420 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56727 <p>Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad&#39;s inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: &#34;Good signature&#34; } to the article&#39;s security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a &#34;Good signature&#34; label. Users and agents relying on Zammad&#39;s signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.</p> <p>Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad&#39;s inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: &#34;Good signature&#34; } to the article&#39;s security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a &#34;Good signature&#34; label. Users and agents relying on Zammad&#39;s signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56727 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1981 <p>Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1981