Login Request a demo
ZC
Product
Zimbra Collaboration Suite
by Synacor · last CVE Aug 13, 2026
On CISA KEVExploited in the wildRansomware-linked
89
CVEs
18
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities89In the news12Timeline
Severity mix
Critical 12High 19Medium 55Low 1
Severity
All severities89Critical12High19Medium55Low1
Exploitation
On CISA KEV18Exploited in the wild18
Watch

Add Zimbra Collaboration Suite to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-18985
6.1
1%
Dec 15
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing
Affected: 8.8.12
CVE-2020-18984
6.1
1%
Dec 15
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to…
Affected: 8.8.12
CVE-2020-13653
6.1
1%
Jul 2
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11
Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +6 more
CVE-2015-7609
6.1
1%
May 30
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra
Affected: 8.6.0; 8.6.0; 8.6.0; 8.6.0; 8.6.0
CVE-2018-14425
6.1
1%
May 30
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before…
Affected: before 8.8.8; 8.8.8; 8.8.8; 8.8.8; 8.8.8; 8.8.9
CVE-2018-18631
6.1
1%
May 29
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS
Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.6.0; 8.7.11; 8.7.11; 8.7.11; +11 more
CVE-2018-14013
6.1
7%
May 29
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients
Affected: before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +15 more
CVE-2018-10939
6.1
1%
May 30
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group
Affected: 8.7.0 through 8.7.11; 8.8.0 through 8.8.8; 8.7.11; 8.7.11; 8.7.11; 8.8.8; +1 more
CVE-2017-17703
6.1
1%
Feb 4
Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS
Affected: before 8.8.3
CVE-2017-7288
6.1
2%
May 23
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
Affected: through 8.7.0
CVE-2016-3999
6.1
1%
Jan 18
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka…
Affected: through 8.6.0
CVE-2016-3412
6.1
1%
Jan 18
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka…
Affected: through 8.6.0
CVE-2016-3411
6.1
4%
Jan 18
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug…
Affected: through 8.6.0
CVE-2016-3410
6.1
1%
Jan 18
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka…
Affected: through 8.6.0
CVE-2016-3409
6.1
1%
Jan 18
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug…
Affected: through 8.6.0
CVE-2016-3408
6.1
1%
Jan 18
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug…
Affected: through 8.6.0
CVE-2016-3407
6.1
1%
Jan 18
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka…
Affected: through 8.6.0
CVE-2026-33372
5.4
0%
Mar 20
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1
Affected: 10.0.0 before 10.1.16
CVE-2024-45517
5.4
1%
Nov 21
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1
Affected: before 8.8.15; 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2024-45514
5.4
1%
Nov 21
An issue was discovered in Zimbra Collaboration (ZCS) through v10.1
Affected: before 8.8.15; 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2024-45512
5.4
0%
Nov 21
An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1
Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more
CVE-2024-45510
5.4
0%
Nov 20
An issue was discovered in Zimbra Collaboration (ZCS) through 10.0
Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more
CVE-2024-45511
5.4
0%
Nov 20
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1
Affected: before 10.0.9; 10.1.0
CVE-2017-8783
5.4
1%
Feb 4
Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS
Affected: before 8.7.10
CVE-2025-25065
5.3
1%
Feb 3
SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to…
Affected: before 9.0.0; 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 9.0.0; 9.0.0; 9.0.0; +34 more
CVE-2020-8633
5.3
1%
Feb 18
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7
Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +2 more
CVE-2018-15131
5.3
2%
May 30
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3
Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +23 more
CVE-2018-17938
5.3
1%
Oct 3
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value
Affected: before 8.8.10
CVE-2018-10950
5.3
1%
May 10
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages…
Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +10 more
CVE-2018-10949
5.3
2%
May 10
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account…
Affected: 8.7.0 through 8.7.11; 8.8 before 8.8.8; 8.6.0
CVE-2024-45513
4.8
0%
Nov 21
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1
Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more
CVE-2024-45194
4.8
0%
Nov 21
In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads
Affected: 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more
CVE-2018-10948
4.8
1%
May 30
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs
Affected: through 8.7.1; 8.8.0
CVE-2026-73571
4.3
0%
Aug 13
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality
Affected: before 10.1.17
CVE-2026-33369
4.3
0%
Mar 20
Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation
Affected: 10.0.0 before 10.1.16
CVE-2026-33371
4.3
0%
Mar 20
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1
Affected: 10.0.0 before 10.1.16
CVE-2026-73575
3.5
0%
Aug 13
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS)…
Affected: before 10.1.17
CVE-2013-7091
–
86%
Dec 13
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read…
Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +10 more
CVE-2013-5119
–
1%
Sep 23
Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN token
Affected: through 6.0.16; 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; +10 more
Page 2 of 2 · 89 total
12