Login Request a demo
ZU
Vendor
zulip
5 products with CVEs on record
87
CVEs
0
On KEV
2
New 30D
Products
ZU
zulip
zulip
9.8
42 CVEs0 on KEV2 new
ZS
Zulip Server
Zulip
9.8
40 CVEs0 on KEV0 new
ZD
Zulip Desktop
Zulip
9.8
2 CVEs0 on KEV0 new
ZU
zulip/zulip
zulip
8.8
2 CVEs0 on KEV0 new
ZU
zulip-mobile
zulip
5.7
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-100404
ZU
zulip
zulip
6.5
0%
Oct 14Zulip: Guests can read new messages in non-subscribed public channels
CVE-2026-102893
ZU
zulip
zulip
9.1
0%
Oct 14Zulip: OpenID Connect authentication ignores the email_verified claim
CVE-2026-40300
ZU
zulip
zulip
6.5
0%
May 12Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history
CVE-2026-26058
ZU
zulip
zulip
6.1
0%
Apr 3Zulip: Path Traversal in Import
CVE-2026-25742
ZU
zulip
zulip
5.3
0%
Apr 3Zulip: Anonymous File Access After Disabling Spectator Access
CVE-2026-25741
ZU
zulip
zulip
7.1
0%
Feb 26Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users
CVE-2026-24050
ZU
zulip
zulip
5.4
0%
Feb 6Zulip affected by Stored XSS in user profile modal
CVE-2025-52559
ZU
zulip
zulip
5.4
0%
Jul 2Zulip XSS in digest preview URL
CVE-2025-47930
ZU
zulip
zulip
5.3
0%
May 15Zulip Server has access control bypass for restrictions on creation of specific channel types
CVE-2025-31478
ZU
zulip
zulip
8.2
0%
Apr 16Zulip Authentication Backend Configuration Bypass
CVE-2025-30369
ZU
zulip
zulip
2.7
0%
Mar 31Zulip allows the deletion of Custom profile fields by administrators of a different organization
CVE-2025-30368
ZU
zulip
zulip
2.7
0%
Mar 31Zulip allows the deletion of organization by administrators of a different organization
CVE-2025-27149
ZU
zulip
zulip
2.7
0%
Mar 31Zulip exports can leak private data
CVE-2025-25195
ZU
zulip
zulip
4.3
0%
Feb 13Zulip events can leak private channel names
CVE-2024-56136
ZU
zulip
zulip
5.3
1%
Jan 16/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server
CVE-2024-36624
ZU
Zulip
Zulip
5.4
0%
Nov 29Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js
CVE-2024-36612
ZS
Zulip Server
Zulip
7.5
1%
Nov 29Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers
CVE-2024-36625
ZU
Zulip
Zulip
5.4
0%
Nov 29Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts
CVE-2024-27286
ZU
zulip
zulip
6.5
1%
Mar 20Moving single messages from public to private streams leaves them accessible
CVE-2024-21630
ZU
zulip
zulip
4.3
0%
Jan 25Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
CVE-2023-47642
ZU
zulip
zulip
4.3
0%
Nov 16Stream description leaks to ex-subscribers in Zulip
CVE-2023-32678
ZU
zulip
zulip
6.5
0%
Aug 25Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers
CVE-2023-33186
ZU
zulip
zulip
6.1
1%
May 30Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip
CVE-2023-28623
ZU
zulip
zulip
3.7
1%
May 19Unauthorized user can register an account in specific configurations in Zulip
CVE-2023-32677
ZU
zulip
zulip
3.1
1%
May 19Users who can send invitations can erroneously add users to streams during invitation in Zulip
CVE-2023-22735
ZU
zulip
zulip
4.6
1%
Feb 7User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip
CVE-2022-41914
ZU
zulip
zulip
3.7
1%
Nov 16Non-constant-time SCIM token comparison in Zulip Server
CVE-2022-36048
ZU
zulip
zulip
4.3
1%
Aug 31IP address leak via image proxy bypass in Zulip Server
CVE-2022-35962
ZU
zulip-mobile
zulip
5.7
1%
Aug 29Crafted link in Zulip message can cause disclosure of credentials
CVE-2016-4427
ZU
Zulip
Zulip
7.5
1%
Jul 28In zulip before 1.3.12, deactivated users could access messages if SSO was enabled
CVE-2016-4426
ZU
Zulip
Zulip
4.3
1%
Jul 28In zulip before 1.3.12, bot API keys were accessible to other users in the same realm
CVE-2022-31168
ZU
zulip
zulip
8.8
1%
Jul 22Zulip Server insufficient authorization for changing bot roles
CVE-2022-31134
ZU
zulip
zulip
4.9
1%
Jul 12Zulip Server public data export contains attachments that are non-public
CVE-2022-31017
ZU
zulip
zulip
2.6
1%
Jun 25Expression Always True vulnerability in Zulip Server
CVE-2022-24751
ZU
zulip
zulip
7.4
1%
Mar 16Race condition in Zulip
CVE-2022-23656
ZU
zulip
zulip
5.4
1%
Mar 2Cross-site scripting vulnerability in Zulip Server
CVE-2021-3967
ZU
zulip/zulip
zulip
8.8
1%
Feb 26Improper Access Control in zulip/zulip
CVE-2022-21706
ZU
zulip
zulip
9.8
1%
Feb 25Multi-use invitations can grant access to other organizations in Zulip
CVE-2021-43799
ZU
zulip
zulip
9.8
5%
Jan 25RabbitMQ exposes ports with weak default secrets in Zulip Server
CVE-2021-3866
ZU
zulip/zulip
zulip
5.4
1%
Jan 20Cross-site Scripting (XSS) - Stored in zulip/zulip
CVE-2021-43791
ZU
zulip
zulip
5.3
1%
Dec 2Ineffective expiration validation for invitation links in Zulip
CVE-2021-41115
ZU
zulip
zulip
6.5
2%
Oct 7Regular expression denial-of-service in Zulip
CVE-2021-30479
ZS
Zulip Server
Zulip
5.3
1%
Apr 14An issue was discovered in Zulip Server before 3.4
CVE-2021-30478
ZS
Zulip Server
Zulip
4.3
1%
Apr 14An issue was discovered in Zulip Server before 3.4
CVE-2021-30477
ZS
Zulip Server
Zulip
4.3
1%
Apr 14An issue was discovered in Zulip Server before 3.4
CVE-2021-30487
ZS
Zulip Server
Zulip
2.7
1%
Apr 14In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip…
CVE-2020-10857
ZD
Zulip Desktop
Zulip
9.8
3%
Feb 5Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution
CVE-2020-10858
ZD
Zulip Desktop
Zulip
5.3
1%
Feb 5Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler
CVE-2020-12759
ZS
Zulip Server
Zulip
6.1
1%
Aug 21Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook
CVE-2020-14194
ZS
Zulip Server
Zulip
5.4
1%
Aug 21Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link
CVE-2020-14215
ZS
Zulip Server
Zulip
7.5
1%
Aug 21Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations
CVE-2020-15070
ZS
Zulip Server
Zulip
8.8
1%
Aug 21Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile…
CVE-2020-9445
ZS
Zulip Server
Zulip
6.1
1%
Apr 20Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality
CVE-2020-9444
ZS
Zulip Server
Zulip
6.1
1%
Apr 20Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality
CVE-2020-10935
ZS
Zulip Server
Zulip
5.4
1%
Apr 20Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover
CVE-2019-19775
ZS
Zulip Server
Zulip
6.1
1%
Dec 18The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users
CVE-2019-18933
ZS
Zulip Server
Zulip
9.8
1%
Nov 21In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub…
CVE-2019-16216
ZS
Zulip Server
Zulip
5.4
1%
Sep 18Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files
CVE-2019-16215
ZS
Zulip Server
Zulip
6.5
1%
Sep 18The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking
CVE-2018-9986
ZS
Zulip Server
Zulip
6.1
1%
Apr 18In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor