Known Vulnerabilities for products from Zabbix
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Zabbix".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-59781 json | Not Provided | 2026-08-18 | 2026-08-19 | |
| CVE-2026-23938 json | Not Provided | 2026-08-18 | 2026-08-18 | |
| CVE-2026-23937 json | Not Provided | 2026-08-18 | 2026-08-18 | |
| CVE-2026-23935 json | Not Provided | 2026-08-18 | 2026-08-18 | |
| CVE-2026-23933 json | Not Provided | 2026-08-18 | 2026-08-19 | |
| CVE-2026-23930 json | An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted ... | Not Provided | 2026-08-18 | 2026-09-08 |
| CVE-2026-23929 json | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing ... | Not Provided | 2026-08-18 | 2026-09-08 |
| CVE-2026-23925 json | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration... | Not Provided | 2026-03-06 | 2026-06-05 |
| CVE-2026-23923 json | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impa... | Not Provided | 2026-03-24 | 2026-09-10 |
| CVE-2026-23922 json | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious... | Not Provided | 2026-08-18 | 2026-09-08 |
| CVE-2026-23921 json | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiServic... | Not Provided | 2026-03-24 | 2026-09-10 |
| CVE-2026-23920 json | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline... | Not Provided | 2026-03-24 | 2026-09-10 |
| CVE-2026-1199 json | Not Provided | 2026-08-18 | 2026-08-18 | |
| CVE-2023-32726 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 8.1 - HIGH | 2023-12-18 | 2024-01-24 |
| CVE-2023-32724 json | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory acces... | 8.8 - HIGH | 2023-10-12 | 2023-10-17 |
| CVE-2023-32723 json | Request to LDAP is sent before user permissions are checked. | 9.1 - CRITICAL | 2023-10-12 | 2024-01-24 |
| CVE-2023-32722 json | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. | 7.8 - HIGH | 2023-10-12 | 2023-10-17 |
| CVE-2023-32721 json | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. | 5.4 - MEDIUM | 2023-10-12 | 2024-01-24 |
| CVE-2023-30958 json | A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's C... | 6.1 - MEDIUM | 2023-08-03 | 2023-11-07 |
| CVE-2023-29458 json | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many... | 7.5 - HIGH | 2023-07-13 | 2023-07-25 |
Known software with vulnerabilities from Zabbix
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Zabbix | Zabbix | 1.0 |