Known Vulnerabilities for products from Zabbix
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Zabbix".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-59787 json | Not Provided | 2026-10-05 | 2026-10-05 | |
| CVE-2026-59786 json | Not Provided | 2026-10-05 | 2026-10-05 | |
| CVE-2026-59783 json | Not Provided | 2026-10-05 | 2026-10-05 | |
| CVE-2026-59782 json | Not Provided | 2026-10-05 | 2026-10-05 | |
| CVE-2026-59781 json | When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the sel... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23938 json | An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script ... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23937 json | The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss ... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23935 json | A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) Htt... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23934 json | An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted re... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23933 json | Not Provided | 2026-08-18 | 2026-08-19 | |
| CVE-2026-23931 json | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values lead... | Not Provided | 2026-08-18 | 2026-09-23 |
| CVE-2026-23930 json | An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted ... | Not Provided | 2026-08-18 | 2026-09-08 |
| CVE-2026-23929 json | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing ... | Not Provided | 2026-08-18 | 2026-09-08 |
| CVE-2026-23928 json | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML d... | Not Provided | 2026-05-06 | 2026-09-18 |
| CVE-2026-23927 json | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Ag... | Not Provided | 2026-05-06 | 2026-09-18 |
| CVE-2026-23926 json | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any ... | Not Provided | 2026-05-06 | 2026-09-18 |
| CVE-2026-23925 json | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration... | Not Provided | 2026-03-06 | 2026-06-05 |
| CVE-2026-23924 json | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Do... | Not Provided | 2026-03-24 | 2026-09-18 |
| CVE-2026-23923 json | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impa... | Not Provided | 2026-03-24 | 2026-09-10 |
| CVE-2026-23922 json | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious... | Not Provided | 2026-08-18 | 2026-09-08 |
Known software with vulnerabilities from Zabbix
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Zabbix | Zabbix | 1.0 |