Zitadel
D
RISKY
41
Total CVEs
21
Crit / High
13
Medium
0%
Unpatched
76%
Patched
7.0
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB
How we collect data →
CVE Trend by Year
Patch Coverage
✓ 22 patched ✗ 0 unpatched ~ 6 under review ⏳ 1 pending score
Intelligence by Audience
PoC Available
1 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"zitadel" port:443
org:"Zitadel" http.status:200
Top EPSS (Exploitation Probability)
Quick Facts for Reporting
Total CVEs tracked
41
Critical severity
3
Actively exploited (CISA)
0
Unpatched ratio
0%
Avg CVSS score
7.0
Security grade
D (RISKY)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
Security News Google News
Recent CVEs
showing 20 of 29
| CVE ID | Severity | Patch | EPSS | Date |
|---|---|---|---|---|
| CVE-2026-105214 | ? N/A | UNKNOWN / UNPATCHED | — | 2026-10-04 |
| CVE-2025-67495 | 8.0 HIGH | PATCHED / FIX AVAILABLE | 0.30% | 2025-12-09 |
| CVE-2025-67494 | 9.3 CRITICAL | PATCH UNDER REVIEW | 0.44% | 2025-12-09 |
| CVE-2025-64717 | 7.4 HIGH | PATCHED / FIX AVAILABLE | 0.47% | 2025-11-13 |
| CVE-2025-64431 | 8.7 HIGH | PATCH UNDER REVIEW | 0.30% | 2025-11-07 |
| CVE-2025-64103 | 8.7 HIGH | PATCH UNDER REVIEW | 0.35% | 2025-10-29 |
| CVE-2025-64102 | 7.7 HIGH | PATCHED / FIX AVAILABLE | 0.34% | 2025-10-29 |
| CVE-2025-64101 | 8.1 HIGH | PATCHED / FIX AVAILABLE | 0.34% | 2025-10-29 |
| CVE-2025-57770 | 5.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.38% | 2025-08-22 |
| CVE-2025-53895 | 7.7 HIGH | PATCHED / FIX AVAILABLE | 0.36% | 2025-07-15 |
| CVE-2025-48936 | 8.1 HIGH | PATCHED / FIX AVAILABLE | 0.39% | 2025-05-30 |
| CVE-2025-46815 | 8.0 HIGH | PATCHED / FIX AVAILABLE | 0.44% | 2025-05-06 |
| CVE-2025-31124 | 5.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.51% | 2025-03-31 |
| CVE-2025-31123 | 8.7 HIGH | PATCH UNDER REVIEW | 0.40% | 2025-03-31 |
| CVE-2025-27507 | 9.0 CRITICAL | PATCH UNDER REVIEW | 0.61% | 2025-03-04 |
| CVE-2024-49757 PoC | 7.5 HIGH | PATCHED / FIX AVAILABLE | 2.52% | 2024-10-25 |
| CVE-2024-49753 | 5.9 MEDIUM | PATCHED / FIX AVAILABLE | 0.65% | 2024-10-25 |
| CVE-2024-46999 | 7.3 HIGH | PATCHED / FIX AVAILABLE | 0.35% | 2024-09-19 |
| CVE-2024-47000 | 8.1 HIGH | PATCHED / FIX AVAILABLE | 0.41% | 2024-09-19 |
| CVE-2024-47060 | 4.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.36% | 2024-09-19 |
Intel
HQZurich, Switzerland
Founded2019
CEOFlorian Forster
CountrySwitzerland
LicenseOpen Source
Trust ScoreD — RISKY
Max CVSS9.3
Last Updated2026-08-03
Top Weaknesses
CWE-287
Improper Authentication
6 occurrences in Zitadel CVEs
(15% of total)
CWE-862
Unknown Weakness Type
4 occurrences in Zitadel CVEs
(10% of total)
CWE-79
Cross-Site Scripting (XSS)
4 occurrences in Zitadel CVEs
(10% of total)
CWE-203
Unknown Weakness Type
4 occurrences in Zitadel CVEs
(10% of total)
CWE-601
Open Redirect
4 occurrences in Zitadel CVEs
(10% of total)
CWE-918
Server-Side Request Forgery (SSRF)
2 occurrences in Zitadel CVEs
(5% of total)
CWE-639
Unknown Weakness Type
2 occurrences in Zitadel CVEs
(5% of total)
CWE-200
Sensitive Information Exposure
2 occurrences in Zitadel CVEs
(5% of total)
Company Profile
Zitadel is an open-source identity and access management (IAM) platform that provides authentication, authorization, and user management solutions for modern applications. It is designed to support multi-tenancy, self-service, and compliance with standards like OAuth 2.0, OpenID Connect, and SAML. As a cybersecurity-relevant vendor, Zitadel helps organizations secure access to their systems and data, with its open-source nature allowing for community scrutiny and rapid patching of vulnerabilities.
Response Metrics
Est. MTTR ⓘ
~67 days
(Average)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ → stable (0%)
CVE count 2026 vs 2025:
14 → 14 CVEs
Patch Speed ⓘ Poor (>65% open)
0% of CVEs still unpatched.
Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
Financial Risk Estimate
Est. GDPR Low
€615K
Est. GDPR High
€6.2M
Based on 3 critical CVEs, 0 CISA KEV, 98% unpatched. Model: GDPR Art.83 · not legal advice.
Actions
Embed Badge
Zitadel D valtersit.com