agentprime: zulipEvery new CVE for zulip.https://agentprime.io/CVE-2026-115474: Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permissionhttps://agentprime.io/advisories/CVE-2026-115474/https://agentprime.io/advisories/CVE-2026-115474/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 19:13:20 GMTCVECVE-2026-115574: Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelshttps://agentprime.io/advisories/CVE-2026-115574/https://agentprime.io/advisories/CVE-2026-115574/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 19:11:47 GMTCVECVE-2026-97701: Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requestshttps://agentprime.io/advisories/CVE-2026-97701/https://agentprime.io/advisories/CVE-2026-97701/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 19:09:47 GMTCVECVE-2026-100404: Zulip: Guests can read new messages in non-subscribed public channelshttps://agentprime.io/advisories/CVE-2026-100404/https://agentprime.io/advisories/CVE-2026-100404/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:50:00 GMTCVECVE-2026-102893: Zulip: OpenID Connect authentication ignores the email_verified claimhttps://agentprime.io/advisories/CVE-2026-102893/https://agentprime.io/advisories/CVE-2026-102893/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:49:03 GMTCVEcriticalCVE-2026-40300: Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/historyhttps://agentprime.io/advisories/CVE-2026-40300/https://agentprime.io/advisories/CVE-2026-40300/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 May 2026 16:33:02 GMTCVECVE-2026-26058: Zulip: Path Traversal in Importhttps://agentprime.io/advisories/CVE-2026-26058/https://agentprime.io/advisories/CVE-2026-26058/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Apr 2026 20:59:08 GMTCVECVE-2026-25742: Zulip: Anonymous File Access After Disabling Spectator Accesshttps://agentprime.io/advisories/CVE-2026-25742/https://agentprime.io/advisories/CVE-2026-25742/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Apr 2026 20:12:07 GMTCVECVE-2026-25741: Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Usershttps://agentprime.io/advisories/CVE-2026-25741/https://agentprime.io/advisories/CVE-2026-25741/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Feb 2026 21:44:34 GMTCVECVE-2026-24050: Zulip affected by Stored XSS in user profile modalhttps://agentprime.io/advisories/CVE-2026-24050/https://agentprime.io/advisories/CVE-2026-24050/CVSS 1.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Feb 2026 18:20:33 GMTCVECVE-2025-52559: Zulip XSS in digest preview URLhttps://agentprime.io/advisories/CVE-2025-52559/https://agentprime.io/advisories/CVE-2025-52559/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Jul 2025 19:31:12 GMTCVECVE-2025-47930: Zulip Server has access control bypass for restrictions on creation of specific channel typeshttps://agentprime.io/advisories/CVE-2025-47930/https://agentprime.io/advisories/CVE-2025-47930/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 May 2025 23:17:29 GMTCVECVE-2025-31478: Zulip Authentication Backend Configuration Bypasshttps://agentprime.io/advisories/CVE-2025-31478/https://agentprime.io/advisories/CVE-2025-31478/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Apr 2025 21:28:23 GMTCVECVE-2025-30369: Zulip allows the deletion of Custom profile fields by administrators of a different organizationhttps://agentprime.io/advisories/CVE-2025-30369/https://agentprime.io/advisories/CVE-2025-30369/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Mar 2025 16:32:54 GMTCVECVE-2025-30368: Zulip allows the deletion of organization by administrators of a different organizationhttps://agentprime.io/advisories/CVE-2025-30368/https://agentprime.io/advisories/CVE-2025-30368/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Mar 2025 16:26:48 GMTCVECVE-2025-27149: Zulip exports can leak private datahttps://agentprime.io/advisories/CVE-2025-27149/https://agentprime.io/advisories/CVE-2025-27149/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Mar 2025 15:33:38 GMTCVECVE-2025-25195: Zulip events can leak private channel nameshttps://agentprime.io/advisories/CVE-2025-25195/https://agentprime.io/advisories/CVE-2025-25195/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Feb 2025 21:47:24 GMTCVECVE-2024-56136: /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip serverhttps://agentprime.io/advisories/CVE-2024-56136/https://agentprime.io/advisories/CVE-2024-56136/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jan 2025 19:25:33 GMTCVECVE-2024-27286: Moving single messages from public to private streams leaves them accessiblehttps://agentprime.io/advisories/CVE-2024-27286/https://agentprime.io/advisories/CVE-2024-27286/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 20 Mar 2024 19:35:59 GMTCVECVE-2024-21630: Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users tohttps://agentprime.io/advisories/CVE-2024-21630/https://agentprime.io/advisories/CVE-2024-21630/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jan 2024 19:30:09 GMTCVECVE-2023-47642: Stream description leaks to ex-subscribers in Zuliphttps://agentprime.io/advisories/CVE-2023-47642/https://agentprime.io/advisories/CVE-2023-47642/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Nov 2023 21:41:46 GMTCVECVE-2023-32678: Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribershttps://agentprime.io/advisories/CVE-2023-32678/https://agentprime.io/advisories/CVE-2023-32678/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Aug 2023 20:04:49 GMTCVECVE-2023-33186: Cross-site scripting vulnerability in Zulip Server development branch via topic tooltiphttps://agentprime.io/advisories/CVE-2023-33186/https://agentprime.io/advisories/CVE-2023-33186/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 May 2023 05:31:37 GMTCVECVE-2023-28623: Unauthorized user can register an account in specific configurations in Zuliphttps://agentprime.io/advisories/CVE-2023-28623/https://agentprime.io/advisories/CVE-2023-28623/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 May 2023 21:04:51 GMTCVECVE-2023-32677: Users who can send invitations can erroneously add users to streams during invitation in Zuliphttps://agentprime.io/advisories/CVE-2023-32677/https://agentprime.io/advisories/CVE-2023-32677/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 May 2023 20:44:47 GMTCVECVE-2023-22735: User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zuliphttps://agentprime.io/advisories/CVE-2023-22735/https://agentprime.io/advisories/CVE-2023-22735/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Feb 2023 18:48:29 GMTCVECVE-2022-41914: Non-constant-time SCIM token comparison in Zulip Serverhttps://agentprime.io/advisories/CVE-2022-41914/https://agentprime.io/advisories/CVE-2022-41914/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Nov 2022 00:00:00 GMTCVECVE-2022-36048: IP address leak via image proxy bypass in Zulip Serverhttps://agentprime.io/advisories/CVE-2022-36048/https://agentprime.io/advisories/CVE-2022-36048/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 31 Aug 2022 19:15:11 GMTCVECVE-2016-4427: Improper access control in zuliphttps://agentprime.io/advisories/CVE-2016-4427/https://agentprime.io/advisories/CVE-2016-4427/Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 Jul 2022 16:32:08 GMTCVECVE-2016-4426: Improper access control in zuliphttps://agentprime.io/advisories/CVE-2016-4426/https://agentprime.io/advisories/CVE-2016-4426/Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 Jul 2022 16:31:52 GMTCVECVE-2022-31168: Zulip Server insufficient authorization for changing bot roleshttps://agentprime.io/advisories/CVE-2022-31168/https://agentprime.io/advisories/CVE-2022-31168/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 Jul 2022 13:05:12 GMTCVECVE-2022-31134: Zulip Server public data export contains attachments that are non-publichttps://agentprime.io/advisories/CVE-2022-31134/https://agentprime.io/advisories/CVE-2022-31134/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 Jul 2022 20:35:10 GMTCVECVE-2022-31017: Expression Always True vulnerability in Zulip Serverhttps://agentprime.io/advisories/CVE-2022-31017/https://agentprime.io/advisories/CVE-2022-31017/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Jun 2022 08:15:16 GMTCVECVE-2022-24751: Race condition in Zuliphttps://agentprime.io/advisories/CVE-2022-24751/https://agentprime.io/advisories/CVE-2022-24751/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Mar 2022 13:30:15 GMTCVECVE-2022-23656: Cross-site scripting vulnerability in Zulip Serverhttps://agentprime.io/advisories/CVE-2022-23656/https://agentprime.io/advisories/CVE-2022-23656/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Mar 2022 20:25:10 GMTCVECVE-2022-21706: Multi-use invitations can grant access to other organizations in Zuliphttps://agentprime.io/advisories/CVE-2022-21706/https://agentprime.io/advisories/CVE-2022-21706/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Feb 2022 23:25:10 GMTCVECVE-2021-43799: RabbitMQ exposes ports with weak default secrets in Zulip Serverhttps://agentprime.io/advisories/CVE-2021-43799/https://agentprime.io/advisories/CVE-2021-43799/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Jan 2022 20:55:11 GMTCVECVE-2021-43791: Ineffective expiration validation for invitation links in Zuliphttps://agentprime.io/advisories/CVE-2021-43791/https://agentprime.io/advisories/CVE-2021-43791/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Dec 2021 00:15:11 GMTCVECVE-2021-41115: Regular expression denial-of-service in Zuliphttps://agentprime.io/advisories/CVE-2021-41115/https://agentprime.io/advisories/CVE-2021-41115/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 Oct 2021 22:20:13 GMTCVE