security@zabbix.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@zabbix.com
03
assessed vulnerabilities (98)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59788US | — | — | ||
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This me… | ||||
| CVE-2026-59787US | — | — | ||
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inj… | ||||
| CVE-2026-59786US | — | — | ||
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapp… | ||||
| CVE-2026-59785US | — | — | ||
Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from th… | ||||
| CVE-2026-59783US | — | — | ||
The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects de… | ||||
| CVE-2026-59782US | — | — | ||
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data… | ||||
| CVE-2026-59781US | high7.8 | — | ||
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the t… | ||||
| CVE-2026-23938US | medium4.9 | — | ||
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of… | ||||
| CVE-2026-23937US | medium6.5 | — | ||
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. | ||||
| CVE-2026-23935US | medium4.9 | — | ||
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality lo… | ||||
| CVE-2026-23934US | medium6.5 | — | ||
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, lead… | ||||
| CVE-2026-23933US | critical9.1OT elevated | — | ||
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for depl… | ||||
| CVE-2026-23931US | medium4.3 | — | ||
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. | ||||
| CVE-2026-23930US | high7.5 | — | ||
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action,… | ||||
| CVE-2026-23929US | medium5.4 | — | ||
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__,… | ||||
| CVE-2026-23922US | medium4.9 | — | ||
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the clien… | ||||
| CVE-2026-1199US | low3.7 | — | ||
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, pote… | ||||
| CVE-2026-23928US | medium6.8 | — | ||
The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perfor… | ||||
| CVE-2026-23927US | medium6.5 | — | ||
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and l… | ||||
| CVE-2026-23926US | medium6.8 | — | ||
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in… | ||||