IceWhaleTech ZimaOS

• CVE-2026-28798 Critical 9.1 Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS 0.4%
• CVE-2026-28442 High 8.6 ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation 0.3%
• CVE-2025-64427 High 7.1 ZimaOS is vulnerable to Server-Side Request Forgery (SSRF) 0.3%
• CVE-2026-28286 High 8.6 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API 0.5%
• CVE-2026-21891 Critical 9.4 ZimaOS has Authentication Bypass via System-Level Username 2.3%
• CVE-2025-58432 Medium 5.2 ZimaOS Privilege Escalation using localhost calls to File API Upload 0.2%
• CVE-2025-58431 Medium 4.8 ZimaOS reads arbitrary files using localhost calls to File API Download 0.2%
• CVE-2024-49359 High 7.5 ZimaOS vulnerable to Directory Listing via Parameter Manipulation 1.0%
• CVE-2024-49358 Medium 5.3 ZimaOS vulnerable to Username Enumeration via API Responses 0.5%
• CVE-2024-49357 High 7.5 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak 23.7%
• CVE-2024-48932 Medium 5.3 ZimaOS Unauthenticated API Discloses Usernames 0.5%
• CVE-2024-48931 High 7.5 ZimaOS Arbitrary File Read via Parameter Manipulation 0.7%