Zimaspace vulnerabilities

Products

• Zimaos 12

Newest

• icewhaletech zimaos Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS CVE-2026-28798 9.1 CriticalApril 3, 2026
• icewhaletech zimaos ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation CVE-2026-28442 8.6 HighMarch 5, 2026
• icewhaletech zimaos ZimaOS is vulnerable to Server-Side Request Forgery (SSRF) CVE-2025-64427 7.1 HighMarch 2, 2026
• icewhaletech zimaos ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API CVE-2026-28286 Public exploit 8.6 HighMarch 2, 2026
• icewhaletech zimaos ZimaOS has Authentication Bypass via System-Level Username CVE-2026-21891 9.4 CriticalJanuary 8, 2026
• icewhaletech zimaos ZimaOS Privilege Escalation using localhost calls to File API Upload CVE-2025-58432 5.2 MediumSeptember 17, 2025
• icewhaletech zimaos ZimaOS reads arbitrary files using localhost calls to File API Download CVE-2025-58431 4.8 MediumSeptember 17, 2025
• icewhaletech zimaos ZimaOS vulnerable to Directory Listing via Parameter Manipulation CVE-2024-49359 7.5 HighOctober 24, 2024
• icewhaletech zimaos ZimaOS vulnerable to Username Enumeration via API Responses CVE-2024-49358 5.3 MediumOctober 24, 2024
• icewhaletech zimaos ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak CVE-2024-49357 EPSS 23.7% 7.5 HighOctober 24, 2024
• icewhaletech zimaos ZimaOS Unauthenticated API Discloses Usernames CVE-2024-48932 5.3 MediumOctober 24, 2024
• icewhaletech zimaos ZimaOS Arbitrary File Read via Parameter Manipulation CVE-2024-48931 7.5 HighOctober 24, 2024