Zimbra vulnerabilities
39 CVEs and advisories name Zimbra as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due
- CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delega
- CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed
- CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d
- CVE-2025-62763Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
- CVE-2024-9665Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
- CVE-2017-20191Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting
- CVE-2017-20188Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting
- CVE-2013-1938Zimbra 2013 has XSS in aspell.php