Zabbix vulnerabilities
100 CVEs and advisories name Zabbix as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-59788Stored XSS vulnerability in OAuth configuration form
- CVE-2026-59787SNMP trap injection in zabbix_trap_receiver.pl
- CVE-2026-59786Active agent heartbeat missing TLS check
- CVE-2026-59785Hidden host credentials inferable via multiselect.get filtering
- CVE-2026-59783Server DoS via binary items
- CVE-2026-59782JavaScript preprocessing memory disclosure
- CVE-2026-59781Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
- CVE-2026-23938Server DoS via JavaScript preprocessing or script items
- CVE-2026-23937Host PSK extraction in Zabbix API
- CVE-2026-23935Use-after-free read in script item/preprocessing HttpRequest body
- CVE-2026-23934Frontend DoS via the validate.api.exists action
- CVE-2026-23933Hardcoded session key in Zabbix 7.4
- CVE-2026-23931Frontend plaintext macro value enumeration via the validatate.api.exists action
- CVE-2026-23930Frontend DoS via the popup.testtriggerexpr action
- CVE-2026-23929Prototype pollution leading to stored XSS
- CVE-2026-1199API and Frontend login lockout race condition
- CVE-2026-23922Email media OAuth secret leak to Super Admin
- CVE-2026-23928Stored XSS vulnerability in the Item history/Plain text widget
- CVE-2026-23927Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
- CVE-2026-23926Stored XSS vulnerability in Host navigator widget maintenance tooltip
- CVE-2026-23924Agent 2 Docker plugin arbitrary file read via Docker API injection
- CVE-2026-23923Unauthenticated arbitrary PHP class instantiation
- CVE-2026-23921Blind, read-only SQL injection in Zabbix API via sortfield parameter
- CVE-2026-23920Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
- CVE-2026-23919Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
- CVE-2026-23925Unauthorized host creation via configuration.import API by low-privilege user with write permissions
- CVE-2025-49643Frontend DoS vulnerability due to asymmetric resource consumption
- CVE-2025-49642Agent builds for AIX vulnerable to library loading hijacking
- CVE-2025-27232Frontend arbitrary file read in oauth.authorize action
- CVE-2025-49641Insufficient permission check for the problem.view.refresh action