CVE Tools
Track your stack

Zulip Server

41 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Zulip Server, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Zulip Server CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Zulip Server CVEs per month
MonthCVEs
2024-111
2024-120
2025-011
2025-020
2025-032
2025-041
2025-050
2025-060
2025-071
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-040
2026-051
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 41 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical12%
  • High820%
  • Medium2868%
  • Low410%

Latest CVEs

The 15 most recently published vulnerabilities affecting Zulip Server.

  1. CVE-2026-40300Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history6.5
  2. CVE-2026-24050Zulip affected by Stored XSS in user profile modal5.4
  3. CVE-2025-52559Zulip XSS in digest preview URL6.8
  4. CVE-2025-31478Zulip Authentication Backend Configuration Bypass8.2
  5. CVE-2025-30369Zulip allows the deletion of Custom profile fields by administrators of a different organization2.7
  6. CVE-2025-27149Zulip exports can leak private data2.7
  7. CVE-2024-56136/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server5.3
  8. CVE-2024-36612Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.7.5
  9. CVE-2024-27286Moving single messages from public to private streams leaves them accessible6.5
  10. CVE-2024-21630Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to4.3
  11. CVE-2023-47642Stream description leaks to ex-subscribers in Zulip4.3
  12. CVE-2023-32678Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers6.5
  13. CVE-2023-33186Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip8.2
  14. CVE-2023-22735User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip4.4
  15. CVE-2022-41914Non-constant-time SCIM token comparison in Zulip Server3.7

Product grouping is registry-driven, with AI assist and human review. How it works