cve@rapid7.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cve@rapid7.com
03
assessed vulnerabilities (238)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-93640US | — | — | ||
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges.… | ||||
| CVE-2026-93639US | —OT elevated | — | ||
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configu… | ||||
| CVE-2026-93638US | — | — | ||
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberm… | ||||
| CVE-2026-93636US | — | — | ||
An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through Searc… | ||||
| CVE-2026-93634US | — | — | ||
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox throug… | ||||
| CVE-2026-93633US | — | — | ||
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled cont… | ||||
| CVE-2026-93631US | — | — | ||
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external acc… | ||||
| CVE-2026-93630US | — | — | ||
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that… | ||||
| CVE-2026-93629US | — | — | ||
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The… | ||||
| CVE-2026-93628US | — | — | ||
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response… | ||||
| CVE-2026-93627US | — | — | ||
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meet… | ||||
| CVE-2026-50057US | — | — | ||
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed s… | ||||
| CVE-2026-50056US | — | — | ||
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. T… | ||||
| CVE-2026-50053US | — | — | ||
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal… | ||||
| CVE-2026-115786US | — | — | ||
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking… | ||||
| CVE-2026-115785US | — | — | ||
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enab… | ||||
| CVE-2026-10632US | — | — | ||
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter… | ||||
| CVE-2026-109682US | — | — | ||
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination.… | ||||
| CVE-2026-109681US | — | — | ||
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mod… | ||||
| CVE-2026-107188US | — | — | ||
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to th… | ||||