CO
Email
Collaboration
On CISA KEVExploited in the wild
74
CVEs
3
On KEV
9.8
Max CVSS
22
New 30D
Severity mix
Critical 4High 20Medium 47Low 2
Watch
Add Collaboration to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-73570 In wildKEV | 8.9 | Aug 13 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Affected: before 10.1.20 |
| CVE-2024-45518 | 8.8 | Oct 22 | An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46 Affected: 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2023-34193 | 8.8 | Jul 6 | File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +31 more |
| CVE-2015-7610 | 8.8 | May 30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before… Affected: 8.6.0; 8.6.0; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +3 more |
| CVE-2026-93639 New | 8.7 | Oct 23 | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation Affected: through 10.1.20 |
| CVE-2026-50053 New | 8.7 | Oct 23 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters Affected: through 10.1.17 |
| CVE-2026-10632 New | 8.7 | Oct 23 | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter Affected: before 10.1.17 |
| CVE-2026-93640 New | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration Affected: through 10.1.21 |
| CVE-2026-50057 New | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions Affected: through 10.1.21 |
| CVE-2026-50056 New | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection Affected: through 10.1.21 |
| CVE-2024-27442 | 7.8 | Aug 12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 Affected: 10.0.0 before 10.0.7; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +32 more |
| CVE-2023-24032 | 7.8 | Jun 15 | In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM… Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2022-41347 | 7.8 | Sep 26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15) Affected: 8.8.15; 9.0.0 |
| CVE-2022-37393 | 7.8 | Aug 16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters Affected: 8.7.6; 8.7.7; 8.7.9; 8.7.10; 8.7.11; 8.7.11; +34 more |
| CVE-2024-33535 | 7.5 | Aug 12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 Affected: 10.0.0 before 10.0.8; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +33 more |
| CVE-2023-41106 | 7.5 | Dec 7 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3 Affected: before 8.8.15; 10.0.0 before 10.0.3; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2022-37041 | 7.5 | Aug 12 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 Affected: 8.8.15; 9.0.0 |
| CVE-2022-45912 | 7.2 | Dec 5 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 Affected: 8.8.15; 9.0.0 |
| CVE-2026-93631 New | 7.1 | Oct 23 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking Affected: through 10.1.20 |
| CVE-2026-50054 | 7.1 | Oct 8 | Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right Affected: before 10.1.20 |
Showing 20