Zabbix

This hub aggregates every CVE we track for Zabbix, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Zabbix.

• CVE-2026-59781Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.7.8Aug 18, 2026
• CVE-2026-23938Server DoS via JavaScript preprocessing or script items4.9Aug 18, 2026
• CVE-2026-23937Host PSK extraction in Zabbix API6.5Aug 18, 2026
• CVE-2026-23935Use-after-free read in script item/preprocessing HttpRequest body4.9Aug 18, 2026
• CVE-2026-23934Frontend DoS via the validate.api.exists action6.5Aug 18, 2026
• CVE-2026-23933Hardcoded session key in Zabbix 7.49.1Aug 18, 2026
• CVE-2026-23931Frontend plaintext macro value enumeration via the validatate.api.exists action4.3Aug 18, 2026
• CVE-2026-23930Frontend DoS via the popup.testtriggerexpr action7.5Aug 18, 2026
• CVE-2026-23929Prototype pollution leading to stored XSS5.4Aug 18, 2026
• CVE-2026-1199API and Frontend login lockout race condition3.7Aug 18, 2026
• CVE-2026-23922Email media OAuth secret leak to Super Admin4.9Aug 18, 2026
• CVE-2026-23928Stored XSS vulnerability in the Item history/Plain text widget6.8May 6, 2026
• CVE-2026-23927Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter6.5May 6, 2026
• CVE-2026-23926Stored XSS vulnerability in Host navigator widget maintenance tooltip6.8May 6, 2026
• CVE-2026-23924Agent 2 Docker plugin arbitrary file read via Docker API injection4.9Mar 24, 2026