Zabbix vulnerabilities

Products

• Zabbix 136
• Frontend 20
• Zabbix-agent2 4
• Server 3
• Agent 2 (msi Packages) 2

Newest

• zabbix Stored XSS vulnerability in OAuth configuration form CVE-2026-59788 5.6 MediumOctober 5, 2026
• zabbix SNMP trap injection in zabbix_trap_receiver.pl CVE-2026-59787 Fix available 5.3 MediumOctober 5, 2026
• zabbix Active agent heartbeat missing TLS check CVE-2026-59786 Fix available 6.9 MediumOctober 5, 2026
• zabbix Hidden host credentials inferable via multiselect.get filtering CVE-2026-59785 Fix available 5.1 MediumOctober 5, 2026
• zabbix Server DoS via binary items CVE-2026-59783 Fix available 2.3 LowOctober 5, 2026
• zabbix JavaScript preprocessing memory disclosure CVE-2026-59782 Fix available 6.9 MediumOctober 5, 2026
• zabbix Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading. CVE-2026-59781 5.4 MediumAugust 18, 2026
• zabbix Server DoS via JavaScript preprocessing or script items CVE-2026-23938 Fix available 2.1 LowAugust 18, 2026
• zabbix Host PSK extraction in Zabbix API CVE-2026-23937 Fix available 6.0 MediumAugust 18, 2026
• zabbix Use-after-free read in script item/preprocessing HttpRequest body CVE-2026-23935 Fix available 6.8 MediumAugust 18, 2026
• zabbix Frontend DoS via the validate.api.exists action CVE-2026-23934 5.1 MediumAugust 18, 2026
• zabbix Hardcoded session key in Zabbix 7.4 CVE-2026-23933 7.7 HighAugust 18, 2026
• zabbix Frontend plaintext macro value enumeration via the validatate.api.exists action CVE-2026-23931 5.3 MediumAugust 18, 2026
• zabbix Frontend DoS via the popup.testtriggerexpr action CVE-2026-23930 Fix available 5.3 MediumAugust 18, 2026
• zabbix Prototype pollution leading to stored XSS CVE-2026-23929 Fix available 8.5 HighAugust 18, 2026
• zabbix API and Frontend login lockout race condition CVE-2026-1199 Fix available 6.9 MediumAugust 18, 2026
• zabbix Email media OAuth secret leak to Super Admin CVE-2026-23922 2.1 LowAugust 18, 2026
• zabbix Stored XSS vulnerability in the Item history/Plain text widget CVE-2026-23928 Fix available 7.3 HighMay 6, 2026
• zabbix Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter CVE-2026-23927 Fix available 5.1 MediumMay 6, 2026
• zabbix Stored XSS vulnerability in Host navigator widget maintenance tooltip CVE-2026-23926 Fix available 7.3 HighMay 6, 2026
• zabbix Agent 2 Docker plugin arbitrary file read via Docker API injection CVE-2026-23924 Fix available 6.1 MediumMarch 24, 2026
• zabbix Unauthenticated arbitrary PHP class instantiation CVE-2026-23923 6.9 MediumMarch 24, 2026
• zabbix Blind, read-only SQL injection in Zabbix API via sortfield parameter CVE-2026-23921 Public exploitFix available 8.7 HighMarch 24, 2026
• zabbix Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection CVE-2026-23920 Fix available 7.7 HighMarch 24, 2026
• zabbix Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server CVE-2026-23919 Fix available 7.1 HighMarch 24, 2026
• zabbix Unauthorized host creation via configuration.import API by low-privilege user with write permissions CVE-2026-23925 Fix available 5.1 MediumMarch 6, 2026
• zabbix frontend, zabbix +1 more Frontend DoS vulnerability due to asymmetric resource consumption CVE-2025-49643 Fix available 6.0 MediumDecember 1, 2025
• zabbix Agent builds for AIX vulnerable to library loading hijacking CVE-2025-49642 5.8 MediumDecember 1, 2025
• zabbix frontend, zabbix +1 more Frontend arbitrary file read in oauth.authorize action CVE-2025-27232 Fix available 6.8 MediumDecember 1, 2025
• zabbix Insufficient permission check for the problem.view.refresh action CVE-2025-49641 Fix available 5.1 MediumOctober 3, 2025
• zabbix DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration CVE-2025-27237 Public exploit 7.3 HighOctober 3, 2025
• zabbix User information disclosure via api_jsonrpc.php on method user.get with param search CVE-2025-27236 Fix available 2.1 LowOctober 3, 2025
• zabbix LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin CVE-2025-27231 Fix available 4.3 MediumOctober 3, 2025
• zabbix Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host CVE-2025-27240 Fix available 7.5 HighSeptember 12, 2025
• zabbix API hostprototype.get lists data to users with insufficient authorization. CVE-2025-27238 Fix available 2.1 LowSeptember 12, 2025
• zabbix Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later. CVE-2025-27233 Fix available 5.7 MediumSeptember 12, 2025
• zabbix Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0. CVE-2025-27234 Fix available 7.3 HighSeptember 12, 2025
• zabbix DoS vulnerability due to uncontrolled resource exhaustion CVE-2024-45700 Fix available 6.0 MediumApril 2, 2025
• zabbix Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps CVE-2024-45699 Fix available 7.5 HighApril 2, 2025
• zabbix Excessive information returned by user.get CVE-2024-42325 Fix available 2.1 LowApril 2, 2025
• zabbix User enumeration via timing attack in Zabbix web interface CVE-2024-36469 Fix available 2.3 LowApril 2, 2025
• zabbix SQL injection in Zabbix API CVE-2024-36465 Fix available EPSS 39.9% 8.6 HighApril 2, 2025
• zabbix Unauthenticated Zabbix frontend takeover when SSO is being used CVE-2024-36466 Fix available 8.8 HighNovember 28, 2024
• zabbix Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported CVE-2024-36464 Fix available 2.7 LowNovember 27, 2024
• zabbix Heap buffer over-read CVE-2024-42333 Fix available 2.7 LowNovember 27, 2024
• zabbix New line injection in Zabbix SNMP traps CVE-2024-42332 Fix available 3.7 LowNovember 27, 2024
• zabbix Use after free in browser_push_error CVE-2024-42331 Fix available 3.3 LowNovember 27, 2024
• zabbix frontend, zabbix +1 more JS - Internal strings in HTTP headers CVE-2024-42330 Fix available 9.1 CriticalNovember 27, 2024
• zabbix JS - Crash on unexpected HTTP server response CVE-2024-42329 Fix available 3.3 LowNovember 27, 2024
• zabbix JS - Crash on empty HTTP server response CVE-2024-42328 Fix available 3.3 LowNovember 27, 2024
• Show olderLoading…