# Zabbix. Every CVE that names Zabbix among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Stored XSS vulnerability in OAuth configuration form](https://agentprime.io/advisories/CVE-2026-59788.md) `CVE-2026-59788` · CVE record: Zabbix Zabbix · CVSS 5.6 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS) - [SNMP trap injection in zabbix_trap_receiver.pl](https://agentprime.io/advisories/CVE-2026-59787.md) `CVE-2026-59787` · CVE record: Zabbix Zabbix · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-143 - [Active agent heartbeat missing TLS check](https://agentprime.io/advisories/CVE-2026-59786.md) `CVE-2026-59786` · CVE record: Zabbix Zabbix · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-940 - [Hidden host credentials inferable via multiselect.get filtering](https://agentprime.io/advisories/CVE-2026-59785.md) `CVE-2026-59785` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-204 - [Server DoS via binary items](https://agentprime.io/advisories/CVE-2026-59783.md) `CVE-2026-59783` · CVE record: Zabbix Zabbix · CVSS 2.3 Low · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption - [JavaScript preprocessing memory disclosure](https://agentprime.io/advisories/CVE-2026-59782.md) `CVE-2026-59782` · CVE record: Zabbix Zabbix · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption - [Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.](https://agentprime.io/advisories/CVE-2026-59781.md) `CVE-2026-59781` · CVE record: Zabbix Zabbix · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-427 - [Server DoS via JavaScript preprocessing or script items](https://agentprime.io/advisories/CVE-2026-23938.md) `CVE-2026-23938` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-248 - [Host PSK extraction in Zabbix API](https://agentprime.io/advisories/CVE-2026-23937.md) `CVE-2026-23937` · CVE record: Zabbix Zabbix · CVSS 6.0 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure - [Use-after-free read in script item/preprocessing HttpRequest body](https://agentprime.io/advisories/CVE-2026-23935.md) `CVE-2026-23935` · CVE record: Zabbix Zabbix · CVSS 6.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption - [Frontend DoS via the validate.api.exists action](https://agentprime.io/advisories/CVE-2026-23934.md) `CVE-2026-23934` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-405 - [Hardcoded session key in Zabbix 7.4](https://agentprime.io/advisories/CVE-2026-23933.md) `CVE-2026-23933` · CVE record: Zabbix Zabbix · CVSS 7.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials - [Frontend plaintext macro value enumeration via the validatate.api.exists action](https://agentprime.io/advisories/CVE-2026-23931.md) `CVE-2026-23931` · CVE record: Zabbix Zabbix · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure - [Frontend DoS via the popup.testtriggerexpr action](https://agentprime.io/advisories/CVE-2026-23930.md) `CVE-2026-23930` · CVE record: Zabbix Zabbix · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-405 - [Prototype pollution leading to stored XSS](https://agentprime.io/advisories/CVE-2026-23929.md) `CVE-2026-23929` · CVE record: Zabbix Zabbix · CVSS 8.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Prototype pollution - [API and Frontend login lockout race condition](https://agentprime.io/advisories/CVE-2026-1199.md) `CVE-2026-1199` · CVE record: Zabbix Zabbix · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Race condition - [Email media OAuth secret leak to Super Admin](https://agentprime.io/advisories/CVE-2026-23922.md) `CVE-2026-23922` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 18 Aug 2026 · Tags: Hard-coded credentials - [Stored XSS vulnerability in the Item history/Plain text widget](https://agentprime.io/advisories/CVE-2026-23928.md) `CVE-2026-23928` · CVE record: Zabbix Zabbix · CVSS 7.3 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site scripting (XSS) - [Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter](https://agentprime.io/advisories/CVE-2026-23927.md) `CVE-2026-23927` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 6 May 2026 · Tags: Hard-coded credentials - [Stored XSS vulnerability in Host navigator widget maintenance tooltip](https://agentprime.io/advisories/CVE-2026-23926.md) `CVE-2026-23926` · CVE record: Zabbix Zabbix · CVSS 7.3 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site scripting (XSS) - [Agent 2 Docker plugin arbitrary file read via Docker API injection](https://agentprime.io/advisories/CVE-2026-23924.md) `CVE-2026-23924` · CVE record: Zabbix Zabbix · CVSS 6.1 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Command injection - [Unauthenticated arbitrary PHP class instantiation](https://agentprime.io/advisories/CVE-2026-23923.md) `CVE-2026-23923` · CVE record: Zabbix Zabbix · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection - [Blind, read-only SQL injection in Zabbix API via sortfield parameter](https://agentprime.io/advisories/CVE-2026-23921.md) `CVE-2026-23921` · CVE record: Zabbix Zabbix · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: SQL injection - [Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection](https://agentprime.io/advisories/CVE-2026-23920.md) `CVE-2026-23920` · CVE record: Zabbix Zabbix · CVSS 7.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Command injection - [Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server](https://agentprime.io/advisories/CVE-2026-23919.md) `CVE-2026-23919` · CVE record: Zabbix Zabbix · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-488 - [Unauthorized host creation via configuration.import API by low-privilege user with write permissions](https://agentprime.io/advisories/CVE-2026-23925.md) `CVE-2026-23925` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Broken access control - [Frontend DoS vulnerability due to asymmetric resource consumption](https://agentprime.io/advisories/CVE-2025-49643.md) `CVE-2025-49643` · CVE record: Zabbix Zabbix · CVSS 6.0 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-405 - [Agent builds for AIX vulnerable to library loading hijacking](https://agentprime.io/advisories/CVE-2025-49642.md) `CVE-2025-49642` · CVE record: Zabbix Zabbix · CVSS 5.8 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-426 - [Frontend arbitrary file read in oauth.authorize action](https://agentprime.io/advisories/CVE-2025-27232.md) `CVE-2025-27232` · CVE record: Zabbix Zabbix · CVSS 6.8 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Server-side request forgery (SSRF) - [Insufficient permission check for the problem.view.refresh action](https://agentprime.io/advisories/CVE-2025-49641.md) `CVE-2025-49641` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Broken access control - [DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration](https://agentprime.io/advisories/CVE-2025-27237.md) `CVE-2025-27237` · CVE record: Zabbix Zabbix · CVSS 7.3 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-427 - [User information disclosure via api_jsonrpc.php on method user.get with param search](https://agentprime.io/advisories/CVE-2025-27236.md) `CVE-2025-27236` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 3 Oct 2025 · Tags: Broken access control - [LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin](https://agentprime.io/advisories/CVE-2025-27231.md) `CVE-2025-27231` · CVE record: Zabbix Zabbix · CVSS 4.3 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Hard-coded credentials - [Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host](https://agentprime.io/advisories/CVE-2025-27240.md) `CVE-2025-27240` · CVE record: Zabbix Zabbix · CVSS 7.5 High · Not analysed yet · Published 12 Sept 2025 · Tags: SQL injection - [API hostprototype.get lists data to users with insufficient authorization.](https://agentprime.io/advisories/CVE-2025-27238.md) `CVE-2025-27238` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 12 Sept 2025 · Tags: Broken access control - [Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.](https://agentprime.io/advisories/CVE-2025-27233.md) `CVE-2025-27233` · CVE record: Zabbix Zabbix · CVSS 5.7 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Command injection - [Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.](https://agentprime.io/advisories/CVE-2025-27234.md) `CVE-2025-27234` · CVE record: Zabbix Zabbix · CVSS 7.3 High · Not analysed yet · Published 12 Sept 2025 · Tags: Command injection - [DoS vulnerability due to uncontrolled resource exhaustion](https://agentprime.io/advisories/CVE-2024-45700.md) `CVE-2024-45700` · CVE record: Zabbix Zabbix · CVSS 6.0 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Denial of service - [Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps](https://agentprime.io/advisories/CVE-2024-45699.md) `CVE-2024-45699` · CVE record: Zabbix Zabbix · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2025 · Tags: Cross-site scripting (XSS) - [Excessive information returned by user.get](https://agentprime.io/advisories/CVE-2024-42325.md) `CVE-2024-42325` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 2 Apr 2025 · Tags: Information disclosure - [User enumeration via timing attack in Zabbix web interface](https://agentprime.io/advisories/CVE-2024-36469.md) `CVE-2024-36469` · CVE record: Zabbix Zabbix · CVSS 2.3 Low · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-208 - [SQL injection in Zabbix API](https://agentprime.io/advisories/CVE-2024-36465.md) `CVE-2024-36465` · CVE record: Zabbix Zabbix · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.40 · Not analysed yet · Published 2 Apr 2025 · Tags: SQL injection - [Unauthenticated Zabbix frontend takeover when SSO is being used](https://agentprime.io/advisories/CVE-2024-36466.md) `CVE-2024-36466` · CVE record: Zabbix Zabbix · CVSS 8.8 High · Not analysed yet · Published 28 Nov 2024 · Tags: Authentication bypass - [Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported](https://agentprime.io/advisories/CVE-2024-36464.md) `CVE-2024-36464` · CVE record: Zabbix Zabbix · CVSS 2.7 Low · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-256 - [Heap buffer over-read](https://agentprime.io/advisories/CVE-2024-42333.md) `CVE-2024-42333` · CVE record: Zabbix Zabbix · CVSS 2.7 Low · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-126 - [New line injection in Zabbix SNMP traps](https://agentprime.io/advisories/CVE-2024-42332.md) `CVE-2024-42332` · CVE record: Zabbix Zabbix · CVSS 3.7 Low · Not analysed yet · Published 27 Nov 2024 - [Use after free in browser_push_error](https://agentprime.io/advisories/CVE-2024-42331.md) `CVE-2024-42331` · CVE record: Zabbix Zabbix · CVSS 3.3 Low · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption - [JS - Internal strings in HTTP headers](https://agentprime.io/advisories/CVE-2024-42330.md) `CVE-2024-42330` · CVE record: Zabbix Zabbix · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption - [JS - Crash on unexpected HTTP server response](https://agentprime.io/advisories/CVE-2024-42329.md) `CVE-2024-42329` · CVE record: Zabbix Zabbix · CVSS 3.3 Low · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption, CWE-690 - [JS - Crash on empty HTTP server response](https://agentprime.io/advisories/CVE-2024-42328.md) `CVE-2024-42328` · CVE record: Zabbix Zabbix · CVSS 3.3 Low · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption, CWE-690 - [SQL injection in user.get API](https://agentprime.io/advisories/CVE-2024-42327.md) `CVE-2024-42327` · CVE record: Zabbix Zabbix · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.79 · Not analysed yet · Published 27 Nov 2024 · Tags: SQL injection - [Use after free vulnerability in browser.c](https://agentprime.io/advisories/CVE-2024-42326.md) `CVE-2024-42326` · CVE record: Zabbix Zabbix · CVSS 4.4 Medium · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption - [Stack buffer overflow in zbx_snmp_cache_handle_engineid](https://agentprime.io/advisories/CVE-2024-36468.md) `CVE-2024-36468` · CVE record: Zabbix Zabbix · CVSS 3.0 Low · Not analysed yet · Published 27 Nov 2024 · Tags: Memory corruption - [Authentication privilege escalation via user groups due to missing authorization checks](https://agentprime.io/advisories/CVE-2024-36467.md) `CVE-2024-36467` · CVE record: Zabbix Zabbix · CVSS 7.5 High · Not analysed yet · Published 27 Nov 2024 · Tags: Broken access control - [Zabbix: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary…](https://agentprime.io/advisories/CVE-2024-36463.md) `CVE-2024-36463` · CVE record: Zabbix Zabbix · CVSS 6.5 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-767 - [Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added](https://agentprime.io/advisories/CVE-2024-22117.md) `CVE-2024-22117` · CVE record: Zabbix Zabbix · CVSS 2.2 Low · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-20 - [Zabbix Arbitrary File Read](https://agentprime.io/advisories/CVE-2024-22123.md) `CVE-2024-22123` · CVE record: Zabbix Zabbix · CVSS 2.7 Low · Not analysed yet · Published 9 Aug 2024 · Tags: Code injection - [Remote code execution within ping script](https://agentprime.io/advisories/CVE-2024-22116.md) `CVE-2024-22116` · CVE record: Zabbix Zabbix · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2024 · Tags: Code injection - [System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission](https://agentprime.io/advisories/CVE-2024-22114.md) `CVE-2024-22114` · CVE record: Zabbix Zabbix · CVSS 4.3 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: CWE-281 - [Allocation of resources without limits or throttling (uncontrolled resource consumption)](https://agentprime.io/advisories/CVE-2024-36462.md) `CVE-2024-36462` · CVE record: Zabbix Zabbix · CVSS 7.5 High · Not analysed yet · Published 9 Aug 2024 · Tags: Denial of service Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .