ZC
Product
Zimbra Collaboration Suite
On CISA KEVExploited in the wildRansomware-linked
89
CVEs
18
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 19Medium 55Low 1
Watch
Add Zimbra Collaboration Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-66376 In wildKEV | 6.1 | Jan 5 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13 |
| CVE-2025-48700 In wildKEV | 6.1 | Jun 23 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2023-37580 In wildKEV | 6.1 | Jul 31 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: 8.8.0 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +8 more |
| CVE-2022-27926 In wildKEV | 6.1 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +18 more |
| CVE-2022-24682 RansomwareIn wildKEV | 6.1 | Feb 9 | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability Affected: 8.8.0 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +25 more |
| CVE-2018-6882 RansomwareIn wildKEV | 6.1 | Mar 27 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: before 8.7.0; 8.7.0; 8.8.0; 8.8.1; 8.8.2; 8.8.3; +3 more |
| CVE-2025-27915 In wildKEV | 5.4 | Mar 12 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Affected: 10.0.0 before 10.0.13; 10.1.0 before 10.1.5; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2026-73576 | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration Affected: before 10.1.17 |
| CVE-2026-73574 | 6.5 | Aug 13 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter Affected: before 10.1.17 |
| CVE-2026-73573 | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the… Affected: before 10.1.17 |
| CVE-2019-6981 | 6.5 | May 29 | Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +22 more |
| CVE-2018-10951 | 6.5 | May 10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer,… Affected: 8.7.0 through 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +8 more |
| CVE-2016-3414 | 6.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 102029 Affected: through 8.6.0 |
| CVE-2016-3401 | 6.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810 Affected: through 8.6.0 |
| CVE-2026-73572 | 6.1 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of… Affected: before 10.1.17 |
| CVE-2026-33368 | 6.1 | Mar 20 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest) Affected: 10.0.0 before 10.1.16 |
| CVE-2026-33370 | 6.1 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 Affected: 10.0.0 before 10.1.16 |
| CVE-2024-45516 | 6.1 | May 14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47 Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2024-50599 | 6.1 | Nov 7 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2020-18985 | 6.1 | Dec 15 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing Affected: 8.8.12 |
| CVE-2020-18984 | 6.1 | Dec 15 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to… Affected: 8.8.12 |
| CVE-2020-13653 | 6.1 | Jul 2 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11 Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +6 more |
| CVE-2015-7609 | 6.1 | May 30 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra Affected: 8.6.0; 8.6.0; 8.6.0; 8.6.0; 8.6.0 |
| CVE-2018-14425 | 6.1 | May 30 | There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before… Affected: before 8.8.8; 8.8.8; 8.8.8; 8.8.8; 8.8.8; 8.8.9 |
| CVE-2018-18631 | 6.1 | May 29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.6.0; 8.7.11; 8.7.11; 8.7.11; +11 more |
| CVE-2018-14013 | 6.1 | May 29 | Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients Affected: before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +15 more |
| CVE-2018-10939 | 6.1 | May 30 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group Affected: 8.7.0 through 8.7.11; 8.8.0 through 8.8.8; 8.7.11; 8.7.11; 8.7.11; 8.8.8; +1 more |
| CVE-2017-17703 | 6.1 | Feb 4 | Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS Affected: before 8.8.3 |
| CVE-2017-7288 | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 8.7.0 |
| CVE-2016-3999 | 6.1 | Jan 18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka… Affected: through 8.6.0 |
| CVE-2016-3412 | 6.1 | Jan 18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka… Affected: through 8.6.0 |
| CVE-2016-3411 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug… Affected: through 8.6.0 |
| CVE-2016-3410 | 6.1 | Jan 18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka… Affected: through 8.6.0 |
| CVE-2016-3409 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug… Affected: through 8.6.0 |
| CVE-2016-3408 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug… Affected: through 8.6.0 |
| CVE-2016-3407 | 6.1 | Jan 18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka… Affected: through 8.6.0 |
| CVE-2026-33372 | 5.4 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 Affected: 10.0.0 before 10.1.16 |
| CVE-2024-45517 | 5.4 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 Affected: before 8.8.15; 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2024-45514 | 5.4 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1 Affected: before 8.8.15; 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2024-45512 | 5.4 | Nov 21 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1 Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2024-45510 | 5.4 | Nov 20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0 Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2024-45511 | 5.4 | Nov 20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 Affected: before 10.0.9; 10.1.0 |
| CVE-2017-8783 | 5.4 | Feb 4 | Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS Affected: before 8.7.10 |
| CVE-2025-25065 | 5.3 | Feb 3 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to… Affected: before 9.0.0; 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2020-8633 | 5.3 | Feb 18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +2 more |
| CVE-2018-15131 | 5.3 | May 30 | An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3 Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +23 more |
| CVE-2018-17938 | 5.3 | Oct 3 | Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value Affected: before 8.8.10 |
| CVE-2018-10950 | 5.3 | May 10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages… Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +10 more |
| CVE-2018-10949 | 5.3 | May 10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account… Affected: 8.7.0 through 8.7.11; 8.8 before 8.8.8; 8.6.0 |
| CVE-2024-45513 | 4.8 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 Affected: before 9.0.0; 10.0.0 before 10.0.9; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |