[ Vendor · 12 CVEs ]
Zimbra
CVEs affecting Zimbra published in the last 30 days, plus any Zimbra CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-93635 | 14 Oct 2026 | CVSS 5.3 | Zimbra Collaboration SuiteLDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On… | |
| CVE-2026-93637 | 14 Oct 2026 | CVSS 3.7 | Zimbra Collaboration SuiteAn authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password… | |
| CVE-2026-50054 | 8 Oct 2026 | CVSS 7.1 | Zimbra Collaboration SuiteAn authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another… | |
| CVE-2026-50055 | 8 Oct 2026 | CVSS 6.5 | Zimbra Collaboration SuiteA policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify… | |
| CVE-2026-10631 | 8 Oct 2026 | CVSS 6.5 | Zimbra Collaboration SuiteAn authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS… | |
| CVE-2026-93641 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share… | |
| CVE-2026-93642 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share… | |
| CVE-2026-93643 | 25 Sep 2026 | CVSS 9.8 | Zimbra Collaboration Suite (ZCS)When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can… | |
| CVE-2026-93647 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers… | |
| CVE-2026-73570 | 13 Aug 2026 | CVSS 8.9 | Zimbra Collaboration Suite (ZCS) OS Command InjectionA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP… | Exploited |
| CVE-2025-66376 | 5 Jan 2026 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site ScriptingZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives… | Exploited |
| CVE-2024-27443 | 12 Aug 2024 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature… | Exploited |