CO
Email
Collaboration
On CISA KEVExploited in the wild
74
CVEs
3
On KEV
9.8
Max CVSS
22
New 30D
Severity mix
Critical 4High 20Medium 47Low 2
Watch
Add Collaboration to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-41349 | 6.1 | Oct 12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS Affected: 8.8.15 |
| CVE-2022-37044 | 6.1 | Aug 12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS… Affected: 8.8.15 |
| CVE-2021-35207 | 6.1 | Jul 2 | An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16 Affected: 8.8 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2021-34807 | 6.1 | Jul 2 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2018-10939 | 6.1 | May 30 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group Affected: 8.8.8 |
| CVE-2022-37043 | 5.7 | Aug 12 | An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 Affected: 8.8.15; 9.0.0 |
| CVE-2026-93633 New | 5.4 | Oct 23 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters Affected: through 10.1.20 |
| CVE-2025-27914 | 5.4 | Mar 12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1 Affected: 10.0.0 before 10.0.11; 9.0.0; 10.1.0 |
| CVE-2024-33536 | 5.4 | Aug 12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 Affected: 10.0.0 before 10.0.8; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +33 more |
| CVE-2024-33533 | 5.4 | Aug 12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2 Affected: 10.0.0 before 10.0.8; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +33 more |
| CVE-2021-35208 | 5.4 | Jul 2 | An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23 Affected: 8.8 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +18 more |
| CVE-2026-93629 New | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity Affected: through 10.1.21 |
| CVE-2026-93628 New | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response Affected: through 10.1.21 |
| CVE-2026-93627 New | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer Affected: through 10.1.21 |
| CVE-2026-93635 | 5.3 | Oct 14 | Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution Affected: through 10.1.21 |
| CVE-2025-67809 | 4.7 | Dec 15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 Affected: 10.0.0 before 10.1.13 |
| CVE-2026-115785 New | 4.3 | Oct 23 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address Affected: through 10.1.20 |
| CVE-2026-93636 New | 4.3 | Oct 23 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name Affected: through 10.1.21 |
| CVE-2026-93634 New | 4.3 | Oct 23 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records Affected: through 10.1.20 |
| CVE-2026-93630 New | 4.3 | Oct 23 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization Affected: before 10.1.21 |
| CVE-2026-73571 | 4.3 | Aug 13 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality Affected: before 10.1.17 |
| CVE-2026-93637 | 3.7 | Oct 14 | Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting Affected: through 10.1.21 |
| CVE-2026-73575 | 3.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS)… Affected: before 10.1.17 |
| CVE-2008-1226 | – | Mar 10 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject… Affected: 4.0.3; 4.5.6 |