Zulip: Guests can read new messages in non-subscribed public channels

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

Moving single messages from public to private streams leaves them accessible

Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

Regular expression denial-of-service in Zulip

Zulip: Path Traversal in Import

Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

Crafted link in Zulip message can cause disclosure of credentials

Zulip affected by Stored XSS in user profile modal

Zulip XSS in digest preview URL

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts

Cross-site scripting vulnerability in Zulip Server

Cross-site Scripting (XSS) - Stored in zulip/zulip

Zulip: Anonymous File Access After Disabling Spectator Access

Zulip Server has access control bypass for restrictions on creation of specific channel types

/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

Ineffective expiration validation for invitation links in Zulip

Zulip Server public data export contains attachments that are non-public

User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip

Zulip events can leak private channel names

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

Stream description leaks to ex-subscribers in Zulip

IP address leak via image proxy bypass in Zulip Server

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm