Login Request a demo
ZA
Vendor
Zabbix
6 products with CVEs on record
152
CVEs
2
On KEV
6
New 30D
Products
ZA
Zabbix
Monitoring
9.9
131 CVEs2 on KEV6 new
FR
Frontend
Zabbix
9.8
14 CVEs0 on KEV0 new
ZA
Zabbix-agent2
Zabbix
9.8
4 CVEs0 on KEV0 new
WS
Web Service Report Generation
Zabbix
5.9
1 CVEs0 on KEV0 new
ZA
Zabbix-agent
Zabbix
8.1
1 CVEs0 on KEV0 new
ZA
Zabbix Agentd
Zabbix
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-59788
ZA
Zabbix
Zabbix
5.7
0%
Oct 5Stored XSS vulnerability in OAuth configuration form
CVE-2026-59787
ZA
Zabbix
Zabbix
5.3
0%
Oct 5SNMP trap injection in zabbix_trap_receiver.pl
CVE-2026-59786
ZA
Zabbix
Zabbix
6.9
0%
Oct 5Active agent heartbeat missing TLS check
CVE-2026-59785
ZA
Zabbix
Zabbix
5.1
0%
Oct 5Hidden host credentials inferable via multiselect.get filtering
CVE-2026-59783
ZA
Zabbix
Zabbix
2.3
0%
Oct 5Server DoS via binary items
CVE-2026-59782
ZA
Zabbix
Zabbix
6.9
0%
Oct 5JavaScript preprocessing memory disclosure
CVE-2026-59781
ZA
Zabbix
Zabbix
7.8
0%
Aug 18Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
CVE-2026-23938
ZA
Zabbix
Zabbix
4.9
0%
Aug 18Server DoS via JavaScript preprocessing or script items
CVE-2026-23937
ZA
Zabbix
Zabbix
6.5
0%
Aug 18Host PSK extraction in Zabbix API
CVE-2026-23935
ZA
Zabbix
Zabbix
4.9
1%
Aug 18Use-after-free read in script item/preprocessing HttpRequest body
CVE-2026-23934
ZA
Zabbix
Zabbix
6.5
1%
Aug 18Frontend DoS via the validate.api.exists action
CVE-2026-23933
ZA
Zabbix
Zabbix
9.1
1%
Aug 18Hardcoded session key in Zabbix 7.4
CVE-2026-23931
ZA
Zabbix
Zabbix
4.3
0%
Aug 18Frontend plaintext macro value enumeration via the validatate.api.exists action
CVE-2026-23930
ZA
Zabbix
Zabbix
7.5
1%
Aug 18Frontend DoS via the popup.testtriggerexpr action
CVE-2026-23929
ZA
Zabbix
Zabbix
5.4
0%
Aug 18Prototype pollution leading to stored XSS
CVE-2026-1199
ZA
Zabbix
Zabbix
3.7
0%
Aug 18API and Frontend login lockout race condition
CVE-2026-23922
ZA
Zabbix
Zabbix
4.9
0%
Aug 18Email media OAuth secret leak to Super Admin
CVE-2026-23928
ZA
Zabbix
Zabbix
6.8
0%
May 6Stored XSS vulnerability in the Item history/Plain text widget
CVE-2026-23927
ZA
Zabbix
Zabbix
6.5
0%
May 6Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
CVE-2026-23926
ZA
Zabbix
Zabbix
6.8
0%
May 6Stored XSS vulnerability in Host navigator widget maintenance tooltip
CVE-2026-23924
ZA
Zabbix
Zabbix
4.9
0%
Mar 24Agent 2 Docker plugin arbitrary file read via Docker API injection
CVE-2026-23923
ZA
Zabbix
Zabbix
5.3
0%
Mar 24Unauthenticated arbitrary PHP class instantiation
CVE-2026-23921
ZA
Zabbix
Zabbix
8.8
4%
Mar 24Blind, read-only SQL injection in Zabbix API via sortfield parameter
CVE-2026-23920
ZA
Zabbix
Zabbix
8.8
0%
Mar 24Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
CVE-2026-23919
ZA
Zabbix
Zabbix
6.0
0%
Mar 24Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
CVE-2026-23925
ZA
Zabbix
Zabbix
8.1
0%
Mar 6Unauthorized host creation via configuration.import API by low-privilege user with write permissions
CVE-2025-49643
ZA
Zabbix
Zabbix
6.5
0%
Dec 1Frontend DoS vulnerability due to asymmetric resource consumption
CVE-2025-49642
ZA
Zabbix
Zabbix
5.9
0%
Dec 1Agent builds for AIX vulnerable to library loading hijacking
CVE-2025-27232
ZA
Zabbix
Zabbix
4.9
0%
Dec 1Frontend arbitrary file read in oauth.authorize action
CVE-2025-49641
ZA
Zabbix
Zabbix
4.3
0%
Oct 3Insufficient permission check for the problem.view.refresh action
CVE-2025-27237
ZA
Zabbix
Zabbix
7.3
0%
Oct 3DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
CVE-2025-27236
ZA
Zabbix
Zabbix
6.5
0%
Oct 3User information disclosure via api_jsonrpc.php on method user.get with param search
CVE-2025-27231
ZA
Zabbix
Zabbix
4.9
0%
Oct 3LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin
CVE-2025-27240
ZA
Zabbix
Zabbix
7.2
1%
Sep 12Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
CVE-2025-27238
ZA
Zabbix
Zabbix
3.5
0%
Sep 12API hostprototype.get lists data to users with insufficient authorization.
CVE-2025-27233
ZA
Zabbix
Zabbix
5.7
0%
Sep 12Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
CVE-2025-27234
ZA
Zabbix
Zabbix
7.3
0%
Sep 12Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
CVE-2024-45700
ZA
Zabbix
Zabbix
6.5
0%
Apr 2DoS vulnerability due to uncontrolled resource exhaustion
CVE-2024-45699
ZA
Zabbix
Zabbix
5.4
0%
Apr 2Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
CVE-2024-42325
ZA
Zabbix
Zabbix
3.5
0%
Apr 2Excessive information returned by user.get
CVE-2024-36469
ZA
Zabbix
Zabbix
3.1
0%
Apr 2User enumeration via timing attack in Zabbix web interface
CVE-2024-36465
ZA
Zabbix
Zabbix
8.8
40%
Apr 2SQL injection in Zabbix API
CVE-2024-36466
ZA
Zabbix
Zabbix
8.8
1%
Nov 28Unauthenticated Zabbix frontend takeover when SSO is being used
CVE-2024-36464
ZA
Zabbix
Zabbix
2.7
1%
Nov 27Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported
CVE-2024-42333
ZA
Zabbix
Zabbix
2.7
1%
Nov 27Heap buffer over-read
CVE-2024-42332
ZA
Zabbix
Zabbix
3.7
1%
Nov 27New line injection in Zabbix SNMP traps
CVE-2024-42331
ZA
Zabbix
Zabbix
3.3
0%
Nov 27Use after free in browser_push_error
CVE-2024-42330
ZA
Zabbix
Zabbix
9.1
1%
Nov 27JS - Internal strings in HTTP headers
CVE-2024-42329
ZA
Zabbix
Zabbix
3.3
0%
Nov 27JS - Crash on unexpected HTTP server response
CVE-2024-42328
ZA
Zabbix
Zabbix
5.5
0%
Nov 27JS - Crash on empty HTTP server response
CVE-2024-42327
ZA
Zabbix
Zabbix
9.9
79%
Nov 27SQL injection in user.get API
CVE-2024-42326
ZA
Zabbix
Zabbix
4.4
0%
Nov 27Use after free vulnerability in browser.c
CVE-2024-36468
ZA
Zabbix
Zabbix
8.2
1%
Nov 27Stack buffer overflow in zbx_snmp_cache_handle_engineid
CVE-2024-36467
ZA
Zabbix
Zabbix
8.8
1%
Nov 27Authentication privilege escalation via user groups due to missing authorization checks
CVE-2024-36463
ZA
Zabbix
Zabbix
8.8
1%
Nov 26The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects
CVE-2024-22117
ZA
Zabbix
Zabbix
2.2
1%
Nov 26Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
CVE-2024-22123
ZA
Zabbix
Zabbix
2.7
1%
Aug 9Zabbix Arbitrary File Read
CVE-2024-22116
ZA
Zabbix
Zabbix
7.2
2%
Aug 9Remote code execution within ping script
CVE-2024-22114
ZA
Zabbix
Zabbix
4.3
1%
Aug 9System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
CVE-2024-36462
ZA
Zabbix
Zabbix
7.5
1%
Aug 9Allocation of resources without limits or throttling (uncontrolled resource consumption)