CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product zabbix:zabbix. Show all products

28 CVEs, showing 1 to 28
CVESeverityTitlePublished
CVE-2026-59788Medium 5.6Stored XSS vulnerability in OAuth configuration form
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59787Medium 5.3SNMP trap injection in zabbix_trap_receiver.pl
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59786Medium 6.9Active agent heartbeat missing TLS check
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59785Medium 5.1Hidden host credentials inferable via multiselect.get filtering
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59783Low 2.3Server DoS via binary items
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59782Medium 6.9JavaScript preprocessing memory disclosure
Assigned by Zabbix
Oct 5, 2026
CVE-2026-59781Medium 5.4Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23938Low 2.1Server DoS via JavaScript preprocessing or script items
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23937Medium 6.0Host PSK extraction in Zabbix API
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23935Medium 6.8Use-after-free read in script item/preprocessing HttpRequest body
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23934Medium 5.1Frontend DoS via the validate.api.exists action
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23933High 7.7Hardcoded session key in Zabbix 7.4
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23931Medium 5.3Frontend plaintext macro value enumeration via the validatate.api.exists action
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23930Medium 5.3Frontend DoS via the popup.testtriggerexpr action
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23929High 8.5Prototype pollution leading to stored XSS
Assigned by Zabbix
Aug 18, 2026
CVE-2026-1199Medium 6.9API and Frontend login lockout race condition
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23922Low 2.1Email media OAuth secret leak to Super Admin
Assigned by Zabbix
Aug 18, 2026
CVE-2026-23928Medium 6.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled.May 6, 2026
CVE-2026-23927Medium 6.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter.May 6, 2026
CVE-2026-23926Medium 6.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator…May 6, 2026
CVE-2026-23924Medium 4.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon.Mar 24, 2026
CVE-2026-23923Medium 5.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes.Mar 24, 2026
CVE-2026-23921High 8.8A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter.Mar 24, 2026
CVE-2026-23920High 8.8Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode.Mar 24, 2026
CVE-2026-23919Medium 6.0For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks).Mar 24, 2026
CVE-2026-23925High 8.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API.Mar 6, 2026
CVE-2022-23134
Known exploited
Low 3.7Possible view of the setup pages by unauthenticated users if config file already exists
Assigned by Zabbix
Jan 13, 2022
CVE-2022-23131
Known exploited
Critical 9.1Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Assigned by Zabbix
Jan 13, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.