Login Request a demo
ZI
Vendor
Zimbra
7 products with CVEs on record
93
CVEs
3
On KEV
22
New 30D
Products
CO
Collaboration
Email
9.8
74 CVEs3 on KEV22 new
CS
Collaboration Server
Zimbra
6.1
6 CVEs0 on KEV0 new
ZI
Zimbra
Zimbra
7.5
5 CVEs0 on KEV0 new
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
9.8
4 CVEs0 on KEV0 new
ZC
Zimbra Collaboration Server
Zimbra
8.8
2 CVEs0 on KEV0 new
ZM
Zm-ajax
Zimbra
4.7
1 CVEs0 on KEV0 new
ZM
Zm-mailbox
Zimbra
6.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115786
New
CO
Collaboration
Zimbra
6.5
0%
Oct 23Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
CVE-2026-115785
New
CO
Collaboration
Zimbra
4.3
1%
Oct 23Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
CVE-2026-93640
New
CO
Collaboration
Zimbra
7.8
0%
Oct 23Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
CVE-2026-50057
New
CO
Collaboration
Zimbra
7.8
0%
Oct 23Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
CVE-2026-50056
New
CO
Collaboration
Zimbra
7.8
0%
Oct 23Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
CVE-2026-93639
New
CO
Collaboration
Zimbra
8.7
0%
Oct 23Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
CVE-2026-93638
New
CO
Collaboration
Zimbra
6.1
0%
Oct 23Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
CVE-2026-93636
New
CO
Collaboration
Zimbra
4.3
0%
Oct 23Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
CVE-2026-93634
New
CO
Collaboration
Zimbra
4.3
0%
Oct 23Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
CVE-2026-93633
New
CO
Collaboration
Zimbra
5.4
0%
Oct 23Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
CVE-2026-93631
New
CO
Collaboration
Zimbra
7.1
0%
Oct 23Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
CVE-2026-93630
New
CO
Collaboration
Zimbra
4.3
0%
Oct 23Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
CVE-2026-93629
New
CO
Collaboration
Zimbra
5.3
0%
Oct 23Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
CVE-2026-93628
New
CO
Collaboration
Zimbra
5.3
0%
Oct 23Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
CVE-2026-93627
New
CO
Collaboration
Zimbra
5.3
0%
Oct 23Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
CVE-2026-50053
New
CO
Collaboration
Zimbra
8.7
0%
Oct 23Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
CVE-2026-10632
New
CO
Collaboration
Zimbra
8.7
0%
Oct 23Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
CVE-2026-93637
CO
Collaboration
Zimbra
3.7
0%
Oct 14Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
CVE-2026-93635
CO
Collaboration
Zimbra
5.3
0%
Oct 14Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
CVE-2026-50055
CO
Collaboration
Zimbra
6.5
0%
Oct 8Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
CVE-2026-50054
CO
Collaboration
Zimbra
7.1
0%
Oct 8Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
CVE-2026-10631
CO
Collaboration
Zimbra
6.5
0%
Oct 8Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
CVE-2026-93647
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
9.3
0%
Sep 25Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
CVE-2026-93643
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
9.8
1%
Sep 25Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
CVE-2026-93642
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
9.3
0%
Sep 25Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
CVE-2026-93641
ZC
Zimbra Collaboration Suite (ZCS)
Zimbra
9.3
0%
Sep 25Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
CVE-2026-73576
CO
Collaboration
Zimbra
6.5
0%
Aug 13In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration
CVE-2026-73575
CO
Collaboration
Zimbra
3.5
0%
Aug 13In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS)…
CVE-2026-73574
CO
Collaboration
Zimbra
6.5
0%
Aug 13In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter
CVE-2026-73573
CO
Collaboration
Zimbra
6.5
0%
Aug 13In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the…
CVE-2026-73572
CO
Collaboration
Zimbra
6.1
0%
Aug 13In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of…
CVE-2026-73571
CO
Collaboration
Zimbra
4.3
0%
Aug 13An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality
CVE-2026-73570
In wildKEV
CO
Collaboration
Zimbra
8.9
72%
Aug 13Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2025-66376
In wildKEV
CO
Collaboration
Zimbra
6.1
20%
Jan 5Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
CVE-2025-67809
CO
Collaboration
Zimbra
4.7
0%
Dec 15An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1
CVE-2024-45515
CO
Collaboration
Zimbra
6.1
0%
Jul 30An issue was discovered in Zimbra Collaboration (ZCS) through 10.1
CVE-2025-27914
CO
Collaboration
Zimbra
5.4
0%
Mar 12An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1
CVE-2024-9665
ZI
Zimbra
Zimbra
6.5
0%
Nov 22Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
CVE-2024-45518
CO
Collaboration
Zimbra
8.8
21%
Oct 22An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46
CVE-2024-33536
CO
Collaboration
Zimbra
5.4
0%
Aug 12An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0
CVE-2024-33535
CO
Collaboration
Zimbra
7.5
1%
Aug 12An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0
CVE-2024-33533
CO
Collaboration
Zimbra
5.4
0%
Aug 12An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2
CVE-2024-27442
CO
Collaboration
Zimbra
7.8
0%
Aug 12An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0
CVE-2024-27443
In wildKEV
CO
Collaboration
Zimbra
6.1
25%
Aug 12Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
CVE-2023-50808
CO
Collaboration
Zimbra
6.1
0%
Feb 13Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI
CVE-2023-48432
CO
Collaboration
Zimbra
6.1
0%
Feb 13An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
CVE-2023-45207
CO
Collaboration
Zimbra
6.1
1%
Feb 13An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
CVE-2023-45206
CO
Collaboration
Zimbra
6.1
0%
Feb 13An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0
CVE-2023-26562
CO
Collaboration
Zimbra
6.5
1%
Feb 13In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp
CVE-2017-20188
ZM
Zm-ajax
Zimbra
4.7
0%
Jan 2A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic
CVE-2023-43103
CO
Collaboration
Zimbra
6.1
0%
Dec 7An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter
CVE-2023-43102
CO
Collaboration
Zimbra
6.1
0%
Dec 7An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4
CVE-2023-41106
CO
Collaboration
Zimbra
7.5
1%
Dec 7An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3
CVE-2023-38750
ZI
Zimbra
Zimbra
7.5
1%
Jul 31In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed
CVE-2023-34193
CO
Collaboration
Zimbra
8.8
1%
Jul 6File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function
CVE-2023-29382
CO
Collaboration
Zimbra
9.8
1%
Jul 6An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component
CVE-2023-29381
CO
Collaboration
Zimbra
9.8
1%
Jul 6An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters
CVE-2023-24032
CO
Collaboration
Zimbra
7.8
1%
Jun 15In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM…
CVE-2023-24031
CO
Collaboration
Zimbra
6.1
0%
Jun 15An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15
CVE-2023-24030
CO
Collaboration
Zimbra
6.1
0%
Jun 15An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15