CVE Tools
Track your stack

Zabbix

148 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Zabbix, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Zabbix CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Zabbix CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-045
2025-054
2025-060
2025-070
2025-080
2025-094
2025-104
2025-110
2025-123
2026-010
2026-020
2026-036
2026-040
2026-053
2026-060
2026-070
2026-0811
2026-090
2026-106
2026-110

Severity

How the 148 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2115%
  • High3525%
  • Medium6344%
  • Low2316%

Latest CVEs

The 15 most recently published vulnerabilities affecting Zabbix.

  1. CVE-2026-59788Stored XSS vulnerability in OAuth configuration form—
  2. CVE-2026-59787SNMP trap injection in zabbix_trap_receiver.pl—
  3. CVE-2026-59786Active agent heartbeat missing TLS check—
  4. CVE-2026-59785Hidden host credentials inferable via multiselect.get filtering—
  5. CVE-2026-59783Server DoS via binary items—
  6. CVE-2026-59782JavaScript preprocessing memory disclosure—
  7. CVE-2026-59781Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.7.8
  8. CVE-2026-23938Server DoS via JavaScript preprocessing or script items4.9
  9. CVE-2026-23937Host PSK extraction in Zabbix API6.5
  10. CVE-2026-23935Use-after-free read in script item/preprocessing HttpRequest body4.9
  11. CVE-2026-23934Frontend DoS via the validate.api.exists action6.5
  12. CVE-2026-23933Hardcoded session key in Zabbix 7.49.1
  13. CVE-2026-23931Frontend plaintext macro value enumeration via the validatate.api.exists action4.3
  14. CVE-2026-23930Frontend DoS via the popup.testtriggerexpr action7.5
  15. CVE-2026-23929Prototype pollution leading to stored XSS5.4

Product grouping is registry-driven, with AI assist and human review. How it works