Skip to content
Zulip vulnerabilities
Newest
-
zulip
Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
CVE-2026-115474
6.5 Medium
-
zulip
Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
CVE-2026-115574
5.3 Medium
-
zulip
Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
CVE-2026-97701
6.5 Medium
-
zulip
Zulip: Guests can read new messages in non-subscribed public channels
CVE-2026-100404
6.5 Medium
-
zulip
Zulip: OpenID Connect authentication ignores the email_verified claim
CVE-2026-102893
9.1 Critical
-
zulip, zulip server +1 more
Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history
CVE-2026-40300
6.0 Medium
-
zulip
Zulip: Path Traversal in Import
CVE-2026-26058
6.1 Medium
-
zulip
Zulip: Anonymous File Access After Disabling Spectator Access
CVE-2026-25742
5.3 Medium
-
zulip
Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users
CVE-2026-25741
7.1 High
-
zulip, zulip server +1 more
Zulip affected by Stored XSS in user profile modal
CVE-2026-24050
1.1 Low
-
zulip, zulip server +1 more
Zulip XSS in digest preview URL
CVE-2025-52559
6.8 Medium
-
zulip
Zulip Server has access control bypass for restrictions on creation of specific channel types
CVE-2025-47930
5.3 Medium
-
zulip, zulip server +1 more
Zulip Authentication Backend Configuration Bypass
CVE-2025-31478
8.2 High
-
zulip, zulip server +1 more
Zulip allows the deletion of Custom profile fields by administrators of a different organization
CVE-2025-30369
2.7 Low
-
zulip
Zulip allows the deletion of organization by administrators of a different organization
CVE-2025-30368
2.7 Low
-
zulip, zulip server +1 more
Zulip exports can leak private data
CVE-2025-27149
4.6 Medium
-
zulip
Zulip events can leak private channel names
CVE-2025-25195
4.3 Medium
-
zulip, zulip server +1 more
/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server
CVE-2024-56136
6.9 Medium
-
zulip
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in...
CVE-2024-36625
6.1 Medium
-
zulip
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in...
CVE-2024-36624
6.1 Medium
-
zulip, zulip server +1 more
Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.
CVE-2024-36612
7.5 High
-
zulip, zulip server +1 more
Moving single messages from public to private streams leaves them accessible
CVE-2024-27286
6.5 Medium
-
zulip, zulip server +1 more
Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
CVE-2024-21630
4.3 Medium
-
zulip, zulip server +1 more
Stream description leaks to ex-subscribers in Zulip
CVE-2023-47642
4.3 Medium
-
zulip, zulip server +1 more
Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers
CVE-2023-32678
6.5 Medium
-
zulip, zulip server +1 more
Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip
CVE-2023-33186
8.2 High
-
zulip
Unauthorized user can register an account in specific configurations in Zulip
CVE-2023-28623
6.5 Medium
-
zulip
Users who can send invitations can erroneously add users to streams during invitation in Zulip
CVE-2023-32677
3.1 Low
-
zulip, zulip server +1 more
User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip
CVE-2023-22735
4.4 Medium
-
zulip, zulip server +1 more
Non-constant-time SCIM token comparison in Zulip Server
CVE-2022-41914
3.7 Low
-
zulip
IP address leak via image proxy bypass in Zulip Server
CVE-2022-36048
4.3 Medium
-
zulip, zulip zulip-mobile +1 more
Crafted link in Zulip message can cause disclosure of credentials
CVE-2022-35962
8.0 High
-
zulip
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
CVE-2016-4427
7.5 High
-
zulip
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
CVE-2016-4426
4.3 Medium
-
zulip
Zulip Server insufficient authorization for changing bot roles
CVE-2022-31168
5.4 Medium
-
zulip, zulip server +1 more
Zulip Server public data export contains attachments that are non-public
CVE-2022-31134
4.9 Medium
-
zulip
Expression Always True vulnerability in Zulip Server
CVE-2022-31017
2.0 Low
-
zulip
Race condition in Zulip
CVE-2022-24751
5.4 Medium
-
zulip, zulip server +1 more
Cross-site scripting vulnerability in Zulip Server
CVE-2022-23656
4.6 Medium
-
zulip, zulip zulip/zulip +1 more
Improper Access Control in zulip/zulip
CVE-2021-3967
4.1 Medium
-
zulip, zulip server +1 more
Multi-use invitations can grant access to other organizations in Zulip
CVE-2022-21706
7.2 High
-
zulip
RabbitMQ exposes ports with weak default secrets in Zulip Server
CVE-2021-43799
Public exploit
8.6 High
-
zulip, zulip zulip/zulip +1 more
Cross-site Scripting (XSS) - Stored in zulip/zulip
CVE-2021-3866
6.8 Medium
-
zulip
Ineffective expiration validation for invitation links in Zulip
CVE-2021-43791
6.5 Medium
-
zulip
Regular expression denial-of-service in Zulip
CVE-2021-41115
4.3 Medium
-
zulip server
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the...
CVE-2021-30479
5.3 Medium
-
zulip server
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the...
CVE-2021-30478
4.3 Medium
-
zulip server
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to...
CVE-2021-30477
4.3 Medium
-
zulip server
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to...
CVE-2021-30487
2.7 Low
-
zulip desktop
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted...
CVE-2020-10857
9.8 Critical
- Show olderLoading…