{"total":2,"items":[{"id":659,"title":"CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability","original_title":"CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability","source_rating":null,"summary":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.\n\nVereiste actie: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Pri","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102490","type":"kev","language":"en","published_at":"2026-10-02T00:00:00+00:00","severity":"hoog","priority":65,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102490","cvss":9.4,"epss":0.00262,"epss_percentile":0.16336,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":0.00262,"source_count":4,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null},{"id":660,"title":"CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability","original_title":"CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability","source_rating":null,"summary":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.\n\nVereiste actie: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updat","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102489","type":"kev","language":"en","published_at":"2026-10-02T00:00:00+00:00","severity":"hoog","priority":65,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102489","cvss":9.4,"epss":0.00582,"epss_percentile":0.45835,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":0.00582,"source_count":4,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null}]}