Zabbix vulnerabilities
100 CVEs and advisories name Zabbix as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-27237DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
- CVE-2025-27236User information disclosure via api_jsonrpc.php on method user.get with param search
- CVE-2025-27231LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin
- CVE-2025-27240Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
- CVE-2025-27238API hostprototype.get lists data to users with insufficient authorization.
- CVE-2025-27233Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
- CVE-2025-27234Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
- CVE-2024-45700DoS vulnerability due to uncontrolled resource exhaustion
- CVE-2024-45699Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
- CVE-2024-42325Excessive information returned by user.get
- CVE-2024-36469User enumeration via timing attack in Zabbix web interface
- CVE-2024-36465SQL injection in Zabbix API
- CVE-2024-36466Unauthenticated Zabbix frontend takeover when SSO is being used
- CVE-2024-36464Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported
- CVE-2024-42333Heap buffer over-read
- CVE-2024-42332New line injection in Zabbix SNMP traps
- CVE-2024-42331Use after free in browser_push_error
- CVE-2024-42330JS - Internal strings in HTTP headers
- CVE-2024-42329JS - Crash on unexpected HTTP server response
- CVE-2024-42328JS - Crash on empty HTTP server response
- CVE-2024-42327SQL injection in user.get API
- CVE-2024-42326Use after free vulnerability in browser.c
- CVE-2024-36468Stack buffer overflow in zbx_snmp_cache_handle_engineid
- CVE-2024-36467Authentication privilege escalation via user groups due to missing authorization checks
- CVE-2024-36463The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objec
- CVE-2024-22117Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
- CVE-2024-22123Zabbix Arbitrary File Read
- CVE-2024-22116Remote code execution within ping script
- CVE-2024-22114System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
- CVE-2024-36462Allocation of resources without limits or throttling (uncontrolled resource consumption)