[ Vendor · 8 CVEs ]
Zabbix
CVEs affecting Zabbix published in the last 30 days, plus any Zabbix CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-59788 | 5 Oct 2026 | CVSS 5.7 | ZabbixThe email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is… | Fix |
| CVE-2026-59782 | 5 Oct 2026 | CVSS 6.9 | ZabbixThe JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data… | Fix |
| CVE-2026-59783 | 5 Oct 2026 | CVSS 2.3 | ZabbixThe Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of… | Fix |
| CVE-2026-59785 | 5 Oct 2026 | CVSS 5.1 | ZabbixHost search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can… | Fix |
| CVE-2026-59786 | 5 Oct 2026 | CVSS 6.9 | ZabbixZabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone… | Fix |
| CVE-2026-59787 | 5 Oct 2026 | CVSS 5.3 | ZabbixThe Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone… | Fix |
| CVE-2022-23131 | 13 Jan 2022 | CVSS 9.8 | Zabbix Frontend Authentication BypassIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a… | ExploitedFix |
| CVE-2022-23134 | 13 Jan 2022 | CVSS 5.3 | Zabbix Frontend Improper Access ControlAfter the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well… | ExploitedFix |