How many CVEs does OTRS have?

OTRS has 170 published CVE records since 2005, including 16 in the last two years.

How many OTRS CVEs are in CISA KEV?

None of OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which OTRS products have the most CVEs?

The OTRS products with the most published CVEs are OTRS, ((OTRS)) Community Edition, otrs itsm, open ticket request system, FAQ.

What are the most common weakness types in OTRS CVEs?

OTRS's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-20 (Improper Input Validation), CWE-264.

Are there public exploits for OTRS vulnerabilities?

Yes — 20 of OTRS's CVEs have a known public exploit.

How many critical OTRS vulnerabilities are there?

OTRS has 5 critical and 29 high-severity CVEs.

What is the average severity of OTRS CVEs?

The average CVSS base score across OTRS's scored CVEs is 5.7.

RadicalNotion.AI

Log in Create an account

170 CVEs

OTRS Vulnerabilities

Name: OTRS vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for OTRS.

170

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

20

Public exploits

PoC or exploit code

5.7

Avg CVSS

2005–2026

Overview

OTRS has 170 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 20 have a known public exploit. The average CVSS base score across scored CVEs is 5.7.

Security scorecard

A quick read on OTRS's vulnerability posture, as a share of its 170 published CVEs.

Average CVSS: 5.7
Critical / high: 20%
Actively exploited (KEV): 0%
Public exploit available: 12%
Patch available: 96%

Severity and exploitation

How the CVSS severity of OTRS's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical5

High29

Medium122

Low14

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OTRS's CVEs are currently listed in CISA's KEV catalog.

Public exploits

20

20 of OTRS's CVEs have a known public exploit available.

Most affected products

The OTRS products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in OTRS CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish OTRS CVE records.

Disclosure activity by year

How many OTRS CVEs were published each year.

2019

14

2020

21

2021

20

2022

14

2023

12

2024

9

2025

7

2026

9

Latest OTRS CVEs

The most recently disclosed vulnerabilities affecting OTRS.

Email with special content can lead to DoS
CWE-770
Medium · CVSS 5.7
EPSS 0.4%2026-06-01
SQL Injection via MySQL Quote Method
CWE-20
Critical · CVSS 9.1
EPSS 0.5%2026-06-01
Bypass DedicatedAgentToCustomerGroups Setting
CWE-200
Medium · CVSS 5.7
EPSS 0.3%2026-06-01
Incorrect handling of permissions in External Interface Config Item List module
CWE-276
Low · CVSS 3.5
EPSS 0.2%2026-06-01
Wrong Permission Handling in Document Search Article Meta Filters
CWE-276
Low · CVSS 3.5
EPSS 0.2%2026-06-01
Denial-of-Service via SVG Rendering in Ticket
CWE-791
Medium · CVSS 6.5
EPSS 0.5%2026-06-01
Reflected XSS in authenticated agent context
CWE-79
High · CVSS 7.1
EPSS 0.4%2026-06-01
Possible information disclosure via External Interface
CWE-269
Medium · CVSS 5.7
EPSS 0.3%2026-05-31
Possible DoS via SQL Box
CWE-770
Medium · CVSS 4.5
EPSS 0.3%2026-04-20
Possible user enumeration
CWE-203
Medium · CVSS 5.3
EPSS 0.3%2025-07-14
Unsafe handling of AJAX calls
CWE-184
Low · CVSS 3.8
EPSS 0.3%2025-06-16
Missing CSRF protection
CWE-1275
Medium · CVSS 6.5
EPSS 0.2%2025-03-10

Get an alert for each new OTRS CVE, with AI-written analysis and remediation steps.

Monitor OTRS CVEs

Other vendors

CVE counts for other vendors.

Grafana172 CVEs Cacti172 CVEs django172 CVEs djangoproject172 CVEs janobe172 CVEs Nokia171 CVEs mervinpraison169 CVEs thorsten169 CVEs

Browse all vendors

Frequently asked questions

Common questions about OTRS vulnerabilities.

How many CVEs does OTRS have?: OTRS has 170 published CVE records since 2005, including 16 in the last two years.
How many OTRS CVEs are in CISA KEV?: None of OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which OTRS products have the most CVEs?: The OTRS products with the most published CVEs are OTRS, ((OTRS)) Community Edition, otrs itsm, open ticket request system, FAQ.
What are the most common weakness types in OTRS CVEs?: OTRS's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-20 (Improper Input Validation), CWE-264.
Are there public exploits for OTRS vulnerabilities?: Yes — 20 of OTRS's CVEs have a known public exploit.
How many critical OTRS vulnerabilities are there?: OTRS has 5 critical and 29 high-severity CVEs.
What is the average severity of OTRS CVEs?: The average CVSS base score across OTRS's scored CVEs is 5.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track OTRS vulnerabilities

Get an alert for each new OTRS CVE, with AI-written analysis and remediation steps.

Create an account See pricing