ZA
Monitoring
Zabbix
On CISA KEVExploited in the wild
123
CVEs
2
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 13High 31Medium 39Low 13
Watch
Add Zabbix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1199 | 3.7 | Aug 18 | API and Frontend login lockout race condition Affected: 6.0.0 through 6.0.46; 7.0.0 through 7.0.27; 7.4.0 through 7.4.11 |
| CVE-2024-42332 | 3.7 | Nov 27 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the… Affected: 6.0.0 before 6.0.35; 6.4.0 before 6.4.20; 7.0.0 before 7.0.3 |
| CVE-2017-2826 | 3.7 | Apr 9 | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X Affected: 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.1; 2.4.1; +17 more |
| CVE-2025-27238 | 3.5 | Sep 12 | Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them Affected: 7.0.0 before 7.0.14; 7.2.0 before 7.2.8 |
| CVE-2024-42325 | 3.5 | Apr 2 | Zabbix API user.get returns all users that share common group with the calling user Affected: 5.0.0 before 5.0.46; 6.0.0 before 6.0.38; 7.0.0 before 7.0.9; 7.2.0 before 7.2.3 |
| CVE-2024-42331 | 3.3 | Nov 27 | In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine Affected: 7.0.0 before 7.0.4 |
| CVE-2024-42329 | 3.3 | Nov 27 | The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails Affected: 7.0.0 before 7.0.4 |
| CVE-2024-36469 | 3.1 | Apr 2 | Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one Affected: 5.0.0 before 5.0.46; 6.0.0 before 6.0.38; 7.0.0 before 7.0.9; 7.2.0 before 7.2.3 |
| CVE-2024-36464 | 2.7 | Nov 27 | When exporting media types, the password is exported in the YAML in plain text Affected: 6.0.0 before 6.0.30; 6.4.0 before 6.4.15 |
| CVE-2024-42333 | 2.7 | Nov 27 | The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c Affected: 6.0.0 before 6.0.34; 6.4.0 before 6.4.19; 7.0.0 before 7.0.4 |
| CVE-2024-22123 | 2.7 | Aug 12 | Setting SMS media allows to set GSM modem file Affected: 5.0.0 through 5.0.42; 6.0.0 through 6.0.30; 6.4.0 through 6.4.15; 7.0.0; 7.0.0; 7.0.0; +11 more |
| CVE-2026-59783 | 2.3 | Oct 5 | Server DoS via binary items Affected: 7.0.0 through 7.0.28; 7.4.0 through 7.4.12 |
| CVE-2024-22117 | 2.2 | Nov 26 | When a URL is added to the map element, it is recorded in the database with sequential IDs Affected: 5.0.0 before 5.0.44; 6.0.0 before 6.0.34; 6.4.0 before 6.4.19; 7.0.0 before 7.0.4 |
Showing 13