Skip to contentZimaspace Zimaos vulnerabilities
- icewhaletech zimaosArbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOSCVE-2026-287989.1 Critical
- icewhaletech zimaosZimaOS: Arbitrary Deletion of Internal System Files via API Path ManipulationCVE-2026-284428.6 High
- icewhaletech zimaosZimaOS is vulnerable to Server-Side Request Forgery (SSRF)CVE-2025-644277.1 High
- icewhaletech zimaosZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via APICVE-2026-28286Public exploit8.6 High
- icewhaletech zimaosZimaOS has Authentication Bypass via System-Level UsernameCVE-2026-218919.4 Critical
- icewhaletech zimaosZimaOS Privilege Escalation using localhost calls to File API UploadCVE-2025-584325.2 Medium
- icewhaletech zimaosZimaOS reads arbitrary files using localhost calls to File API DownloadCVE-2025-584314.8 Medium
- icewhaletech zimaosZimaOS vulnerable to Directory Listing via Parameter ManipulationCVE-2024-493597.5 High
- icewhaletech zimaosZimaOS vulnerable to Username Enumeration via API ResponsesCVE-2024-493585.3 Medium
- icewhaletech zimaosZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data LeakCVE-2024-49357EPSS 23.7%7.5 High
- icewhaletech zimaosZimaOS Unauthenticated API Discloses UsernamesCVE-2024-489325.3 Medium
- icewhaletech zimaosZimaOS Arbitrary File Read via Parameter ManipulationCVE-2024-489317.5 High