# cve.now: Zabbix

The newest entries naming Zabbix as an affected vendor (up to 200), of 100 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-59788](https://cve.now/CVE-2026-59788.md): Stored XSS vulnerability in OAuth configuration form (CVSS 5.6)
- [CVE-2026-59787](https://cve.now/CVE-2026-59787.md): SNMP trap injection in zabbix\_trap\_receiver.pl (CVSS 5.3)
- [CVE-2026-59786](https://cve.now/CVE-2026-59786.md): Active agent heartbeat missing TLS check (CVSS 6.9)
- [CVE-2026-59785](https://cve.now/CVE-2026-59785.md): Hidden host credentials inferable via multiselect.get filtering (CVSS 5.1)
- [CVE-2026-59783](https://cve.now/CVE-2026-59783.md): Server DoS via binary items (CVSS 2.3)
- [CVE-2026-59782](https://cve.now/CVE-2026-59782.md): JavaScript preprocessing memory disclosure (CVSS 6.9)
- [CVE-2026-59781](https://cve.now/CVE-2026-59781.md): Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading. (CVSS 5.4)
- [CVE-2026-23938](https://cve.now/CVE-2026-23938.md): Server DoS via JavaScript preprocessing or script items (CVSS 2.1)
- [CVE-2026-23937](https://cve.now/CVE-2026-23937.md): Host PSK extraction in Zabbix API (CVSS 6.0)
- [CVE-2026-23935](https://cve.now/CVE-2026-23935.md): Use-after-free read in script item/preprocessing HttpRequest body (CVSS 6.8)
- [CVE-2026-23934](https://cve.now/CVE-2026-23934.md): Frontend DoS via the validate.api.exists action (CVSS 5.1)
- [CVE-2026-23933](https://cve.now/CVE-2026-23933.md): Hardcoded session key in Zabbix 7.4 (CVSS 7.7)
- [CVE-2026-23931](https://cve.now/CVE-2026-23931.md): Frontend plaintext macro value enumeration via the validatate.api.exists action (CVSS 5.3)
- [CVE-2026-23930](https://cve.now/CVE-2026-23930.md): Frontend DoS via the popup.testtriggerexpr action (CVSS 5.3)
- [CVE-2026-23929](https://cve.now/CVE-2026-23929.md): Prototype pollution leading to stored XSS (CVSS 8.5)
- [CVE-2026-1199](https://cve.now/CVE-2026-1199.md): API and Frontend login lockout race condition (CVSS 6.9)
- [CVE-2026-23922](https://cve.now/CVE-2026-23922.md): Email media OAuth secret leak to Super Admin (CVSS 2.1)
- [CVE-2026-23928](https://cve.now/CVE-2026-23928.md): Stored XSS vulnerability in the Item history/Plain text widget (CVSS 7.3)
- [CVE-2026-23927](https://cve.now/CVE-2026-23927.md): Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter (CVSS 5.1)
- [CVE-2026-23926](https://cve.now/CVE-2026-23926.md): Stored XSS vulnerability in Host navigator widget maintenance tooltip (CVSS 7.3)
- [CVE-2026-23924](https://cve.now/CVE-2026-23924.md): Agent 2 Docker plugin arbitrary file read via Docker API injection (CVSS 6.1)
- [CVE-2026-23923](https://cve.now/CVE-2026-23923.md): Unauthenticated arbitrary PHP class instantiation (CVSS 6.9)
- [CVE-2026-23921](https://cve.now/CVE-2026-23921.md): Blind, read-only SQL injection in Zabbix API via sortfield parameter (CVSS 8.7)
- [CVE-2026-23920](https://cve.now/CVE-2026-23920.md): Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection (CVSS 7.7)
- [CVE-2026-23919](https://cve.now/CVE-2026-23919.md): Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server (CVSS 7.1)
- [CVE-2026-23925](https://cve.now/CVE-2026-23925.md): Unauthorized host creation via configuration.import API by low-privilege user with write permissions (CVSS 5.1)
- [CVE-2025-49643](https://cve.now/CVE-2025-49643.md): Frontend DoS vulnerability due to asymmetric resource consumption (CVSS 6.0)
- [CVE-2025-49642](https://cve.now/CVE-2025-49642.md): Agent builds for AIX vulnerable to library loading hijacking (CVSS 5.8)
- [CVE-2025-27232](https://cve.now/CVE-2025-27232.md): Frontend arbitrary file read in oauth.authorize action (CVSS 6.8)
- [CVE-2025-49641](https://cve.now/CVE-2025-49641.md): Insufficient permission check for the problem.view.refresh action (CVSS 5.1)
- [CVE-2025-27237](https://cve.now/CVE-2025-27237.md): DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration (CVSS 7.3)
- [CVE-2025-27236](https://cve.now/CVE-2025-27236.md): User information disclosure via api\_jsonrpc.php on method user.get with param search (CVSS 2.1)
- [CVE-2025-27231](https://cve.now/CVE-2025-27231.md): LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin (CVSS 4.3)
- [CVE-2025-27240](https://cve.now/CVE-2025-27240.md): Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host (CVSS 7.5)
- [CVE-2025-27238](https://cve.now/CVE-2025-27238.md): API hostprototype.get lists data to users with insufficient authorization. (CVSS 2.1)
- [CVE-2025-27233](https://cve.now/CVE-2025-27233.md): Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later. (CVSS 5.7)
- [CVE-2025-27234](https://cve.now/CVE-2025-27234.md): Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0. (CVSS 7.3)
- [CVE-2024-45700](https://cve.now/CVE-2024-45700.md): DoS vulnerability due to uncontrolled resource exhaustion (CVSS 6.0)
- [CVE-2024-45699](https://cve.now/CVE-2024-45699.md): Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps (CVSS 7.5)
- [CVE-2024-42325](https://cve.now/CVE-2024-42325.md): Excessive information returned by user.get (CVSS 2.1)
- [CVE-2024-36469](https://cve.now/CVE-2024-36469.md): User enumeration via timing attack in Zabbix web interface (CVSS 2.3)
- [CVE-2024-36465](https://cve.now/CVE-2024-36465.md): SQL injection in Zabbix API (CVSS 8.6)
- [CVE-2024-36466](https://cve.now/CVE-2024-36466.md): Unauthenticated Zabbix frontend takeover when SSO is being used (CVSS 8.8)
- [CVE-2024-36464](https://cve.now/CVE-2024-36464.md): Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported (CVSS 2.7)
- [CVE-2024-42333](https://cve.now/CVE-2024-42333.md): Heap buffer over-read (CVSS 2.7)
- [CVE-2024-42332](https://cve.now/CVE-2024-42332.md): New line injection in Zabbix SNMP traps (CVSS 3.7)
- [CVE-2024-42331](https://cve.now/CVE-2024-42331.md): Use after free in browser\_push\_error (CVSS 3.3)
- [CVE-2024-42330](https://cve.now/CVE-2024-42330.md): JS - Internal strings in HTTP headers (CVSS 9.1)
- [CVE-2024-42329](https://cve.now/CVE-2024-42329.md): JS - Crash on unexpected HTTP server response (CVSS 3.3)
- [CVE-2024-42328](https://cve.now/CVE-2024-42328.md): JS - Crash on empty HTTP server response (CVSS 3.3)
- [CVE-2024-42327](https://cve.now/CVE-2024-42327.md): SQL injection in user.get API (CVSS 9.9)
- [CVE-2024-42326](https://cve.now/CVE-2024-42326.md): Use after free vulnerability in browser.c (CVSS 4.4)
- [CVE-2024-36468](https://cve.now/CVE-2024-36468.md): Stack buffer overflow in zbx\_snmp\_cache\_handle\_engineid (CVSS 3.0)
- [CVE-2024-36467](https://cve.now/CVE-2024-36467.md): Authentication privilege escalation via user groups due to missing authorization checks (CVSS 7.5)
- [CVE-2024-36463](https://cve.now/CVE-2024-36463.md): The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objec (CVSS 6.5)
- [CVE-2024-22117](https://cve.now/CVE-2024-22117.md): Value of sysmap\_element\_url can be de-synchronized causing the map element to crash when new URLs is added (CVSS 2.2)
- [CVE-2024-22123](https://cve.now/CVE-2024-22123.md): Zabbix Arbitrary File Read (CVSS 2.7)
- [CVE-2024-22116](https://cve.now/CVE-2024-22116.md): Remote code execution within ping script (CVSS 9.9)
- [CVE-2024-22114](https://cve.now/CVE-2024-22114.md): System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission (CVSS 4.3)
- [CVE-2024-36462](https://cve.now/CVE-2024-36462.md): Allocation of resources without limits or throttling (uncontrolled resource consumption) (CVSS 7.5)
- [CVE-2024-36461](https://cve.now/CVE-2024-36461.md): Direct access to memory pointers within the JS engine for modification (CVSS 9.1)
- [CVE-2024-36460](https://cve.now/CVE-2024-36460.md): Front-end audit log shows passwords in plaintext (CVSS 8.1)
- [CVE-2024-22122](https://cve.now/CVE-2024-22122.md): AT(GSM) Command Injection (CVSS 3.0)
- [CVE-2024-22121](https://cve.now/CVE-2024-22121.md): Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe (CVSS 6.1)
- [CVE-2024-22120](https://cve.now/CVE-2024-22120.md): Time Based SQL Injection in Zabbix Server Audit Log (CVSS 9.1)
- [CVE-2024-22119](https://cve.now/CVE-2024-22119.md): Stored XSS in graph items select form (CVSS 5.5)
- [CVE-2023-32728](https://cve.now/CVE-2023-32728.md): Code injection in zabbix\_agent2 smart.disk.get caused by smartctl plugin (CVSS 4.6)
- [CVE-2023-32727](https://cve.now/CVE-2023-32727.md): Code execution vulnerability in icmpping (CVSS 6.8)
- [CVE-2023-32726](https://cve.now/CVE-2023-32726.md): Possible buffer overread from reading DNS responses (CVSS 3.9)
- [CVE-2023-32725](https://cve.now/CVE-2023-32725.md): Leak of zbx\_session cookie when using a scheduled report that includes a dashboard with a URL widget. (CVSS 9.6)
- [CVE-2023-32724](https://cve.now/CVE-2023-32724.md): JavaScript engine memory pointers are directly available for Zabbix users for modification (CVSS 9.1)
- [CVE-2023-32723](https://cve.now/CVE-2023-32723.md): Inefficient permission check in class CControllerAuthenticationUpdate (CVSS 8.5)
- [CVE-2023-32722](https://cve.now/CVE-2023-32722.md): Stack-buffer Overflow in library module zbxjson (CVSS 9.6)
- [CVE-2023-32721](https://cve.now/CVE-2023-32721.md): Stored XSS in Maps element (CVSS 7.6)
- [CVE-2023-29453](https://cve.now/CVE-2023-29453.md): Agent 2 package are built with Go version affected by CVE-2023-24538 (CVSS 9.8)
- [CVE-2023-29457](https://cve.now/CVE-2023-29457.md): Insufficient validation of Action form input fields (CVSS 6.3)
- [CVE-2023-29458](https://cve.now/CVE-2023-29458.md): Duktape 2.6 bug crashes JavaScript putting too many values in valstack. (CVSS 5.9)
- [CVE-2023-29456](https://cve.now/CVE-2023-29456.md): Inefficient URL schema validation (CVSS 5.7)
- [CVE-2023-29455](https://cve.now/CVE-2023-29455.md): Reflected XSS in several fields of graph form (CVSS 5.4)
- [CVE-2023-29454](https://cve.now/CVE-2023-29454.md): Persistent XSS in the user form (CVSS 5.4)
- [CVE-2023-29452](https://cve.now/CVE-2023-29452.md): Remove possibility to add html into Geomap attribution field (CVSS 5.5)
- [CVE-2023-29451](https://cve.now/CVE-2023-29451.md): Denial of service caused by a bug in the JSON parser (CVSS 4.7)
- [CVE-2023-29450](https://cve.now/CVE-2023-29450.md): Unauthorized limited filesystem access from preprocessing (CVSS 8.5)
- [CVE-2023-29449](https://cve.now/CVE-2023-29449.md): Limited control of resource utilization in JS preprocessing (CVSS 5.9)
- [CVE-2022-46768](https://cve.now/CVE-2022-46768.md): File name information disclosure vulnerability in Zabbix Web Service Report Generation (CVSS 5.9)
- [CVE-2022-43516](https://cve.now/CVE-2022-43516.md): Zabbix Agent installer adds “allow all TCP any any” firewall rule (CVSS 6.5)
- [CVE-2022-43515](https://cve.now/CVE-2022-43515.md): X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode (CVSS 5.3)
- [CVE-2022-40626](https://cve.now/CVE-2022-40626.md): Reflected XSS in the backurl parameter of Zabbix Frontend (CVSS 4.8)
- [CVE-2022-35230](https://cve.now/CVE-2022-35230.md): Reflected XSS in graphs page of Zabbix Frontend (CVSS 3.7)
- [CVE-2022-35229](https://cve.now/CVE-2022-35229.md): Reflected XSS in discovery page of Zabbix Frontend (CVSS 3.7)
- [CVE-2022-24919](https://cve.now/CVE-2022-24919.md): Reflected XSS in graph configuration window of Zabbix Frontend (CVSS 3.7)
- [CVE-2022-24918](https://cve.now/CVE-2022-24918.md): Reflected XSS in item configuration window of Zabbix Frontend (CVSS 3.7)
- [CVE-2022-24917](https://cve.now/CVE-2022-24917.md): Reflected XSS in service configuration window of Zabbix Frontend (CVSS 3.7)
- [CVE-2022-24349](https://cve.now/CVE-2022-24349.md): Reflected XSS in action configuration window of Zabbix Frontend (CVSS 4.6)
- [CVE-2022-23134](https://cve.now/CVE-2022-23134.md): Possible view of the setup pages by unauthenticated users if config file already exists (CVSS 3.7, KEV)
- [CVE-2022-23133](https://cve.now/CVE-2022-23133.md): Stored XSS in host groups configuration window in Zabbix Frontend (CVSS 6.3)
- [CVE-2022-23132](https://cve.now/CVE-2022-23132.md): Incorrect permissions of \[/var/run/zabbix\] forces dac\_override (CVSS 3.3)
- [CVE-2022-23131](https://cve.now/CVE-2022-23131.md): Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML (CVSS 9.1, KEV)
- [CVE-2013-3628](https://cve.now/CVE-2013-3628.md): Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability (no CVSS)
- [CVE-2017-2824](https://cve.now/CVE-2017-2824.md): An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zabbix
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.