Known Vulnerabilities for products from Zabbix

Listed below are 20 of the newest known vulnerabilities associated with the vendor "Zabbix".

These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.

Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2026-59781 json Not Provided 2026-08-18 2026-08-19
CVE-2026-23938 json An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script ... Not Provided 2026-08-18 2026-09-23
CVE-2026-23937 json The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss ... Not Provided 2026-08-18 2026-09-23
CVE-2026-23935 json A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) Htt... Not Provided 2026-08-18 2026-09-23
CVE-2026-23934 json An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted re... Not Provided 2026-08-18 2026-09-23
CVE-2026-23933 json In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Cur... Not Provided 2026-08-18 2026-09-23
CVE-2026-23931 json The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values lead... Not Provided 2026-08-18 2026-09-23
CVE-2026-23930 json An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted ... Not Provided 2026-08-18 2026-09-08
CVE-2026-23929 json Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing ... Not Provided 2026-08-18 2026-09-08
CVE-2026-23928 json The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML d... Not Provided 2026-05-06 2026-09-18
CVE-2026-23927 json A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Ag... Not Provided 2026-05-06 2026-09-18
CVE-2026-23926 json An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any ... Not Provided 2026-05-06 2026-09-18
CVE-2026-23925 json An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration... Not Provided 2026-03-06 2026-06-05
CVE-2026-23924 json Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Do... Not Provided 2026-03-24 2026-09-18
CVE-2026-23923 json An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impa... Not Provided 2026-03-24 2026-09-10
CVE-2026-23922 json The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious... Not Provided 2026-08-18 2026-09-08
CVE-2026-23921 json A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiServic... Not Provided 2026-03-24 2026-09-10
CVE-2026-23920 json Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline... Not Provided 2026-03-24 2026-09-10
CVE-2026-23919 json For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessi... Not Provided 2026-03-24 2026-09-18
CVE-2026-1199 json Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted... Not Provided 2026-08-18 2026-09-08
Results limited to 20 most recent vulnerabilities

Known software with vulnerabilities from Zabbix

Type Vendor Product Version
ApplicationZabbixZabbix1.0

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report