zulip zulip server

Name: zulip zulip server
Brand: zulip

productUS

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical3high28medium3low

updated 2026-10-28

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-18933US	critical9.8OT elevated	1.35% (71st)	—	2.0.7	2019-11-21	1.7.0 → 2.0.7
CVE-2017-0896US	medium6.5OT elevated	1.28% (70th)	—	no fix	2017-06-02	19 versions
CVE-2019-16215US	medium6.5	1.25% (69th)	—	2.0.5	2019-09-18	< 2.0.5
CVE-2020-15070US	high8.8	1.21% (68th)	—	2.1.7	2020-08-21	< 2.1.7
CVE-2022-21706US	critical9.8OT elevated	1.21% (68th)	—	4.10.0	2022-02-26	2.0.0 → 4.10.0
CVE-2017-0881US	medium4.3OT elevated	1.10% (66th)	—	1.4.3	2017-03-28	< 1.4.3
CVE-2017-0910US	high8.8OT elevated	1.09% (65th)	—	1.7.1	2017-11-27	< 1.7.1
CVE-2022-31134US	medium4.9	0.92% (60th)	—	5.4	2022-07-12	2.1.0 → 5.4
CVE-2020-14215US	high7.5	0.89% (59th)	—	2.1.5	2020-08-21	< 2.1.5
CVE-2019-19775US	medium6.1	0.86% (58th)	—	2.0.8	2019-12-18	1.9.0 → 2.0.8
CVE-2021-30479US	medium5.3	0.86% (58th)	—	3.4	2021-04-15	< 3.4
CVE-2018-9990US	medium6.1	0.81% (57th)	—	1.7.2	2018-04-18	< 1.7.2
CVE-2018-9987US	medium6.1	0.81% (57th)	—	1.7.2	2018-04-18	1.5.0 → 1.7.2
CVE-2018-9986US	medium6.1	0.81% (57th)	—	1.7.2	2018-04-18	< 1.7.2
CVE-2018-9999US	medium5.4	0.73% (54th)	—	1.7.2	2018-04-18	< 1.7.2
CVE-2020-10935US	medium5.4	0.72% (54th)	—	2.1.3	2020-04-20	< 2.1.3
CVE-2020-14194US	medium5.4	0.69% (52nd)	—	2.1.5	2020-08-21	< 2.1.5
CVE-2019-16216US	medium5.4	0.68% (52nd)	—	2.0.5	2019-09-18	1.8.0 → 2.0.5
CVE-2020-12759US	medium6.1	0.67% (52nd)	—	2.1.5	2020-08-21	< 2.1.5
CVE-2020-9445US	medium6.1	0.67% (52nd)	—	2.1.3	2020-04-20	< 2.1.3
CVE-2020-9444US	medium6.1	0.67% (52nd)	—	no fix	2020-04-20	≤ 2.1.3
CVE-2021-30477US	medium4.3	0.66% (51st)	—	3.4	2021-04-15	< 3.4
CVE-2021-30487US	low2.7	0.65% (51st)	—	3.4	2021-04-15	3.0 → 3.4
CVE-2023-33186US	medium6.1	0.62% (49th)	—	no fix	2023-05-30	= 7.0
CVE-2024-36612US	—	0.59% (48th)	—	no fix	2024-11-29	8.0 → 8.3
CVE-2024-56136US	medium5.3	0.59% (48th)	—	9.4	2025-01-16	7.0 → 9.4
CVE-2022-23656US	medium5.4	0.58% (48th)	—	2022-03-01	2022-03-02	2021-06-03 → 2022-03-01
CVE-2021-30478US	medium4.3	0.57% (47th)	—	3.4	2021-04-15	< 3.4
CVE-2022-41914US	low3.7	0.57% (47th)	—	5.7	2022-11-16	5.0 → 5.7
CVE-2024-27286US	—	0.52% (44th)	—	8.3	2024-03-20	3.0 → 8.3
CVE-2023-22735US	medium4.6	0.52% (44th)	—	no fix	2023-02-07	= 2023-01-09
CVE-2023-32678US	medium6.5	0.48% (41st)	—	7.3	2023-08-25	< 7.3
CVE-2023-47642US	medium4.3	0.48% (41st)	—	7.5	2023-11-16	1.3.0 → 7.5
CVE-2024-21630US	medium4.3OT elevated	0.37% (30th)	—	8.1	2024-01-25	2 versions
CVE-2025-31478US	—	0.36% (30th)	—	10.2	2025-04-16	< 10.2
CVE-2025-27149US	low2.7	0.30% (23rd)	—	10.0	2025-03-31	2.1.0 → 10.0
CVE-2025-52559US	medium5.4	0.28% (21st)	—	10.4	2025-07-02	2 versions
CVE-2025-30369US	—	0.28% (20th)	—	10.1	2025-03-31	1.6.0 → 10.1
CVE-2026-24050US	medium5.4	0.27% (18th)	—	11.5	2026-02-06	5.0 → 11.5
CVE-2026-40300US	medium6.5	0.25% (16th)	—	no fix	2026-05-12	= 10.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-269Improper Privilege Management4 CVEs
CWE-287Improper Authentication3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-266Incorrect Privilege Assignment2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-285Improper Authorization2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE40 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan