CVE Tools
Track your stack

Collaboration

51 CVEs tracked. 3 of them are in CISA KEV.

This hub aggregates every CVE we track for Collaboration, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Collaboration CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Collaboration CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-031
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-101
2025-110
2025-121
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-087
2026-090
2026-100

Severity

How the 51 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical48%
  • High1224%
  • Medium3161%
  • Low48%

Latest CVEs

The 15 most recently published vulnerabilities affecting Collaboration.

  1. CVE-2026-73576In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecur...6.3
  2. CVE-2026-73575In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient ...3.1
  3. CVE-2026-73574In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated...3.1
  4. CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An a...3.1
  5. CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment conte...6.1
  6. CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacke...3.1
  7. CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sani...8.9
  8. CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.7.2
  9. CVE-2025-67809An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because...4.7
  10. CVE-2025-62763Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.5.0
  11. CVE-2024-45515An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata w...6.1
  12. CVE-2025-27914An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to...5.4
  13. CVE-2024-45518An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-...8.8
  14. CVE-2024-33535An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling o...7.5
  15. CVE-2024-33533An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. Thi...5.4

Product grouping is registry-driven, with AI assist and human review. How it works