ZO
Product
zoneminder
96
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 17High 17Medium 54Low 0
Watch
Add zoneminder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30971 | 8.8 | Oct 16 | ZoneMinder: Authenticated RCE via command injection in monitor Device Path Affected: < 1.36.40; >= 1.38.0, < 1.38.2; >= 1.39.0, < 1.39.2 |
| CVE-2026-102607 | 8.8 | Oct 16 | ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature Affected: < 1.38.2 |
| CVE-2026-76060 | 8.8 | Aug 27 | OS Command Injection in PayRange API Affected: 1.37.48 before 1.38.3 |
| CVE-2026-72556 | 8.8 | Aug 11 | ZoneMinder ZoneMinder - Remote Code Execution Affected: through 1.39.17 |
| CVE-2026-27470 | 8.8 | Feb 21 | ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields Affected: < 1.36.38; >= 1.37.61, < 1.38.1 |
| CVE-2023-26039 | 8.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26034 | 8.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2019-7346 | 8.8 | Feb 4 | A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the… Affected: through 1.32.3 |
| CVE-2016-10206 | 8.8 | Mar 3 | Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and… Affected: through 1.30.0 |
| CVE-2017-5368 | 8.8 | Feb 6 | ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make changes to the web… Affected: 1.29.0; 1.30.0 |
| CVE-2020-25730 | 8.2 | Apr 4 | Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive… Affected: before 1.34.21 |
| CVE-2023-26032 | 8.1 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2022-39289 | 7.5 | Oct 7 | Database log access in ZoneMinder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-7347 | 7.5 | Feb 4 | A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users… Affected: through 1.32.3 |
| CVE-2016-10140 | 7.5 | Jan 13 | Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote… Affected: 1.30.0 |
| CVE-2019-7350 | 7.3 | Feb 4 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account Affected: through 1.32.3 |
| CVE-2016-10205 | 7.3 | Mar 3 | Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie Affected: through 1.30.0 |
Showing 17