Login Request a demo
CO
Email
Collaboration
by Zimbra · last CVE Oct 23, 2026
On CISA KEVExploited in the wild
74
CVEs
3
On KEV
9.8
Max CVSS
22
New 30D
Vulnerabilities74In the news12Timeline
Severity mix
Critical 4High 20Medium 47Low 2
Severity
All severities74Critical4High20Medium47Low2
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add Collaboration to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-66376
In wildKEV
6.1
20%
Jan 5
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Affected: 10.0 before 10.0.18; 10.1 before 10.1.13
CVE-2024-27443
In wildKEV
6.1
25%
Aug 12
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Affected: 10.0.0 before 10.0.7; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +32 more
CVE-2026-115786
New
6.5
0%
Oct 23
Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
Affected: through 10.1.20
CVE-2026-50055
6.5
0%
Oct 8
Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
Affected: before 10.1.20
CVE-2026-10631
6.5
0%
Oct 8
Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
Affected: before 10.1.20
CVE-2026-73576
6.5
0%
Aug 13
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration
Affected: before 10.1.17
CVE-2026-73574
6.5
0%
Aug 13
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter
Affected: before 10.1.17
CVE-2026-73573
6.5
0%
Aug 13
In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the…
Affected: before 10.1.17
CVE-2023-26562
6.5
1%
Feb 13
In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp
Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2020-35123
6.5
2%
Dec 17
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to…
Affected: after 8.8.0 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +22 more
CVE-2026-93638
New
6.1
0%
Oct 23
Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
Affected: through 10.1.17
CVE-2026-73572
6.1
0%
Aug 13
In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of…
Affected: before 10.1.17
CVE-2024-45515
6.1
0%
Jul 30
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1
Affected: through 10.1.0
CVE-2023-50808
6.1
0%
Feb 13
Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI
Affected: before 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +32 more
CVE-2023-48432
6.1
0%
Feb 13
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
Affected: 10.0.0 before 10.0.6; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2023-45207
6.1
1%
Feb 13
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
Affected: 10.0.0 before 10.0.5; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2023-45206
6.1
0%
Feb 13
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
Affected: 10.0.0 before 10.0.5; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2023-43103
6.1
0%
Dec 7
An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter
Affected: before 8.8.15; 10.0.0 before 10.0.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2023-43102
6.1
0%
Dec 7
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4
Affected: before 8.8.15; 10.0.0 before 10.0.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2023-24031
6.1
0%
Jun 15
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15
Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +17 more
CVE-2023-24030
6.1
0%
Jun 15
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15
Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2022-45913
6.1
0%
Jan 6
An issue was discovered in Zimbra Collaboration (ZCS) 9.0
Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2022-45911
6.1
0%
Jan 6
An issue was discovered in Zimbra Collaboration (ZCS) 9.0
Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +22 more
CVE-2022-41348
6.1
1%
Oct 12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0
Affected: 9.0.0
CVE-2022-41351
6.1
1%
Oct 12
In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck…
Affected: 8.8.15
CVE-2022-41350
6.1
1%
Oct 12
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS
Affected: 8.8.15
CVE-2022-41349
6.1
0%
Oct 12
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS
Affected: 8.8.15
CVE-2022-37044
6.1
1%
Aug 12
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS…
Affected: 8.8.15
CVE-2021-35207
6.1
3%
Jul 2
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16
Affected: 8.8 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2021-34807
6.1
1%
Jul 2
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0
Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2018-10939
6.1
1%
May 30
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group
Affected: 8.8.8
CVE-2022-37043
5.7
0%
Aug 12
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0
Affected: 8.8.15; 9.0.0
CVE-2026-93633
New
5.4
0%
Oct 23
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
Affected: through 10.1.20
CVE-2025-27914
5.4
0%
Mar 12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1
Affected: 10.0.0 before 10.0.11; 9.0.0; 10.1.0
CVE-2024-33536
5.4
0%
Aug 12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0
Affected: 10.0.0 before 10.0.8; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +33 more
CVE-2024-33533
5.4
0%
Aug 12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2
Affected: 10.0.0 before 10.0.8; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +33 more
CVE-2021-35208
5.4
1%
Jul 2
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23
Affected: 8.8 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +18 more
CVE-2026-93629
New
5.3
0%
Oct 23
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
Affected: through 10.1.21
CVE-2026-93628
New
5.3
0%
Oct 23
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
Affected: through 10.1.21
CVE-2026-93627
New
5.3
0%
Oct 23
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
Affected: through 10.1.21
CVE-2026-93635
5.3
0%
Oct 14
Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
Affected: through 10.1.21
CVE-2025-67809
4.7
0%
Dec 15
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1
Affected: 10.0.0 before 10.1.13
CVE-2026-115785
New
4.3
1%
Oct 23
Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
Affected: through 10.1.20
CVE-2026-93636
New
4.3
0%
Oct 23
Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
Affected: through 10.1.21
CVE-2026-93634
New
4.3
0%
Oct 23
Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
Affected: through 10.1.20
CVE-2026-93630
New
4.3
0%
Oct 23
Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
Affected: before 10.1.21
CVE-2026-73571
4.3
0%
Aug 13
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality
Affected: before 10.1.17
Showing 47