SY
Vendor
Synacor
113
CVEs
36
On KEV
0
New 30D
Products
ZC9.8
Zimbra Collaboration Suite
Synacor
89 CVEs18 on KEV0 new
ZC9.8
Zimbra Collaboration Suite (ZCS)
Synacor
18 CVEs17 on KEV0 new
ZC6.1
Zimbra Collaborate Suite (ZCS)
Synacor
1 CVEs1 on KEV0 new
ZC9.8
Zimbra Collaboration Server
Synacor
5 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73576 | ZC Zimbra Collaboration Suite Synacor | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration |
| CVE-2026-73575 | ZC Zimbra Collaboration Suite Synacor | 3.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS)… |
| CVE-2026-73574 | ZC Zimbra Collaboration Suite Synacor | 6.5 | Aug 13 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter |
| CVE-2026-73573 | ZC Zimbra Collaboration Suite Synacor | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the… |
| CVE-2026-73572 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of… |
| CVE-2026-73571 | ZC Zimbra Collaboration Suite Synacor | 4.3 | Aug 13 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality |
| CVE-2026-73570 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 8.9 | Aug 13 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability |
| CVE-2026-33373 | ZC Zimbra Collaboration Suite Synacor | 8.8 | Mar 30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 |
| CVE-2026-33372 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 |
| CVE-2026-33371 | ZC Zimbra Collaboration Suite Synacor | 4.3 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 |
| CVE-2026-33370 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 |
| CVE-2026-33369 | ZC Zimbra Collaboration Suite Synacor | 4.3 | Mar 20 | Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation |
| CVE-2026-33368 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Mar 20 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest) |
| CVE-2025-66376 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 6.1 | Jan 5 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability |
| CVE-2025-68645 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 8.8 | Dec 22 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability |
| CVE-2025-48700 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 6.1 | Jun 23 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability |
| CVE-2024-45516 | ZC Zimbra Collaboration Suite Synacor | 6.1 | May 14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47 |
| CVE-2025-32354 | ZC Zimbra Collaboration Suite Synacor | 8.8 | Apr 29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due… |
| CVE-2025-27915 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 5.4 | Mar 12 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability |
| CVE-2025-25065 | ZC Zimbra Collaboration Suite Synacor | 5.3 | Feb 3 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to… |
| CVE-2025-25064 | ZC Zimbra Collaboration Suite Synacor | 8.8 | Feb 3 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a… |
| CVE-2024-54663 | ZC Zimbra Collaboration Suite Synacor | 7.5 | Dec 19 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1 |
| CVE-2024-45517 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 |
| CVE-2024-45513 | ZC Zimbra Collaboration Suite Synacor | 4.8 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 |
| CVE-2024-45194 | ZC Zimbra Collaboration Suite Synacor | 4.8 | Nov 21 | In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads |
| CVE-2024-45514 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Nov 21 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1 |
| CVE-2024-45512 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Nov 21 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1 |
| CVE-2024-45510 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Nov 20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0 |
| CVE-2024-45511 | ZC Zimbra Collaboration Suite Synacor | 5.4 | Nov 20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1 |
| CVE-2024-50599 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Nov 7 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints |
| CVE-2024-45519 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 9.8 | Oct 2 | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability |
| CVE-2024-27443 In wildKEV | ZC Zimbra Collaboration Suite (ZCS) Synacor | 6.1 | Aug 12 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability |
| CVE-2023-37580 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 6.1 | Jul 31 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability |
| CVE-2023-34192 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 9.0 | Jul 6 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability |
| CVE-2022-3569 | ZC Zimbra Collaboration Suite (ZCS) Synacor | 7.8 | Oct 17 | Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra'… |
| CVE-2022-41352 RansomwareIn wildKEV | ZC Zimbra Collaboration Suite Synacor | 9.8 | Sep 26 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability |
| CVE-2022-37042 RansomwareIn wildKEV | ZC Zimbra Collaboration Suite Synacor | 9.8 | Aug 11 | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability |
| CVE-2022-27926 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 6.1 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability |
| CVE-2022-27925 RansomwareIn wildKEV | ZC Zimbra Collaboration Suite Synacor | 7.2 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability |
| CVE-2022-27924 RansomwareIn wildKEV | ZC Zimbra Collaboration Suite Synacor | 7.5 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability |
| CVE-2022-24682 RansomwareIn wildKEV | ZC Zimbra Collaboration Suite Synacor | 6.1 | Feb 9 | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability |
| CVE-2020-18985 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Dec 15 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing |
| CVE-2020-18984 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Dec 15 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to… |
| CVE-2020-13653 | ZC Zimbra Collaboration Suite Synacor | 6.1 | Jul 2 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11 |
| CVE-2020-12846 | ZC Zimbra Collaboration Suite Synacor | 8.0 | Jun 3 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file |
| CVE-2020-8633 | ZC Zimbra Collaboration Suite Synacor | 5.3 | Feb 18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 |
| CVE-2020-7796 In wildKEV | ZC Zimbra Collaboration Suite Synacor | 9.8 | Feb 18 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability |
| CVE-2019-11318 | ZC Zimbra Collaboration Server Synacor | 5.4 | Jan 27 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS |
| CVE-2015-2249 | ZC Zimbra Collaboration Server Synacor | 5.4 | Jan 27 | Zimbra Collaboration before 8.6.0 patch5 has XSS |
| CVE-2014-8563 | ZC Zimbra Collaboration Server Synacor | 9.8 | Jan 27 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS |
| CVE-2014-5500 | ZC Zimbra Collaboration Server Synacor | 6.1 | Jan 27 | Synacor Zimbra Collaboration before 8.0.8 has XSS |
| CVE-2015-7609 | ZC Zimbra Collaboration Suite Synacor | 6.1 | May 30 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra |
| CVE-2015-2230 | ZC Zimbra Collaboration Server Synacor | 6.1 | May 30 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console |
| CVE-2018-14425 | ZC Zimbra Collaboration Suite Synacor | 6.1 | May 30 | There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before… |
| CVE-2018-10948 | ZC Zimbra Collaboration Suite Synacor | 4.8 | May 30 | Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs |
| CVE-2018-15131 | ZC Zimbra Collaboration Suite Synacor | 5.3 | May 30 | An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3 |
| CVE-2019-6981 | ZC Zimbra Collaboration Suite Synacor | 6.5 | May 29 | Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component |
| CVE-2019-6980 | ZC Zimbra Collaboration Suite Synacor | 9.8 | May 29 | Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component |
| CVE-2018-20160 | ZC Zimbra Collaboration Suite Synacor | 9.8 | May 29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by… |
| CVE-2018-18631 | ZC Zimbra Collaboration Suite Synacor | 6.1 | May 29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS |