zimbra

Top products

The 15 most recently published vulnerabilities affecting zimbra.

• CVE-2026-73576In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecur...6.3Aug 13, 2026
• CVE-2026-73575In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient ...3.1Aug 13, 2026
• CVE-2026-73574In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated...3.1Aug 13, 2026
• CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An a...3.1Aug 13, 2026
• CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment conte...6.1Aug 13, 2026
• CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacke...3.1Aug 13, 2026
• CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sani...KEV8.9Aug 13, 2026
• CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.KEV7.2Jan 5, 2026
• CVE-2025-67809An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because...4.7Dec 15, 2025
• CVE-2025-62763Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.5.0Oct 21, 2025
• CVE-2024-45515An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata w...6.1Jul 30, 2025
• CVE-2025-27914An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to...5.4Mar 12, 2025
• CVE-2024-9665Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability6.5Nov 22, 2024
• CVE-2024-45518An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-...8.8Oct 22, 2024
• CVE-2024-33536An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject an...5.4Aug 12, 2024