How many CVEs does OTRS have?

OTRS has 170 published CVE records since 2005, including 16 in the last two years.

How many OTRS CVEs are in CISA KEV?

None of OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which OTRS products have the most CVEs?

The OTRS products with the most published CVEs are OTRS, ((OTRS)) Community Edition, otrs itsm, open ticket request system, FAQ.

What are the most common weakness types in OTRS CVEs?

OTRS's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-790 (Improper Filtering of Special Elements).

Are there public exploits for OTRS vulnerabilities?

Yes — 12 of OTRS's CVEs have a known public exploit.

How many critical OTRS vulnerabilities are there?

OTRS has 5 critical and 29 high-severity CVEs.

What is the average severity of OTRS CVEs?

The average CVSS base score across OTRS's scored CVEs is 5.7.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

170 CVEs

OTRS Vulnerabilities

Name: OTRS vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for OTRS.

170

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

12

Public exploits

PoC or exploit code

5.7

Avg CVSS

2005–2026

Overview

OTRS has 170 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 12 have a known public exploit. The average CVSS base score across scored CVEs is 5.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting OTRS products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on OTRS's vulnerability posture, as a share of its 170 published CVEs.

Average CVSS: 5.7
Critical / high: 20%
Actively exploited (KEV): 0%
Public exploit available: 7%
Patch available: 95%

Severity and exploitation

How the CVSS severity of OTRS's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical5

High29

Medium122

Low14

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OTRS's CVEs are currently listed in CISA's KEV catalog.

Public exploits

12

12 of OTRS's CVEs have a known public exploit available.

Most affected products

The OTRS products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in OTRS CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish OTRS CVE records.

Disclosure activity by year

How many OTRS CVEs were published each year.

2019

14

2020

21

2021

20

2022

14

2023

12

2024

9

2025

7

2026

9

Latest OTRS CVEs

The most recently disclosed vulnerabilities affecting OTRS.

Email with special content can lead to DoS
CWE-770
Medium · CVSS 5.7
EPSS 0.2%2026-06-01
SQL Injection via MySQL Quote Method
CWE-20
Critical · CVSS 9.1
EPSS 0.4%2026-06-01
Bypass DedicatedAgentToCustomerGroups Setting
CWE-200
Medium · CVSS 5.7
EPSS 0.2%2026-06-01
Incorrect handling of permissions in External Interface Config Item List module
CWE-276
Low · CVSS 3.5
EPSS 0.1%2026-06-01
Wrong Permission Handling in Document Search Article Meta Filters
CWE-276
Low · CVSS 3.5
EPSS 0.1%2026-06-01
Denial-of-Service via SVG Rendering in Ticket
CWE-791
Medium · CVSS 6.5
EPSS 0.3%2026-06-01
Reflected XSS in authenticated agent context
CWE-79
High · CVSS 7.1
EPSS 0.2%2026-06-01
Possible information disclosure via External Interface
CWE-269
Medium · CVSS 5.7
EPSS 0.2%2026-05-31
Possible DoS via SQL Box
CWE-770
Medium · CVSS 4.5
EPSS 0.2%2026-04-20
Possible user enumeration
CWE-203
Medium · CVSS 5.3
EPSS 0.2%2025-07-14
Unsafe handling of AJAX calls
CWE-184
Low · CVSS 3.8
EPSS 0.2%2025-06-16
Missing CSRF protection
CWE-1275
Medium · CVSS 6.5
EPSS 0.1%2025-03-10

Track new OTRS CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor OTRS CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Spring172 CVEs Esri172 CVEs Frappe172 CVEs janobe172 CVEs Cacti171 CVEs Cloud Foundry171 CVEs Arm170 CVEs MongoDB168 CVEs

Browse all vendors

Frequently asked questions

Common questions about OTRS vulnerabilities.

How many CVEs does OTRS have?: OTRS has 170 published CVE records since 2005, including 16 in the last two years.
How many OTRS CVEs are in CISA KEV?: None of OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which OTRS products have the most CVEs?: The OTRS products with the most published CVEs are OTRS, ((OTRS)) Community Edition, otrs itsm, open ticket request system, FAQ.
What are the most common weakness types in OTRS CVEs?: OTRS's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-790 (Improper Filtering of Special Elements).
Are there public exploits for OTRS vulnerabilities?: Yes — 12 of OTRS's CVEs have a known public exploit.
How many critical OTRS vulnerabilities are there?: OTRS has 5 critical and 29 high-severity CVEs.
What is the average severity of OTRS CVEs?: The average CVSS base score across OTRS's scored CVEs is 5.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track OTRS vulnerabilities

Monitor new OTRS vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing