Log in Start free

Zabbix

Products

ProductCVEsExploitedLatest
Frontend112Dec 12, 2022
Zabbix84–Oct 5, 2026
Zabbix agent 2 (MSI packages)2–Dec 19, 2022
Proxy, Server1–Jan 13, 2022
Web Service Report Generation1–Dec 19, 2022
Zabbix agent (MSI packages)1–Dec 12, 2022

Exploited and recent CVEs

  • CVE-2022-23134 Low 3.7 Exploited Possible view of the setup pages by unauthenticated users if config file already exists 95.3%
  • CVE-2022-23131 Critical 9.1 Exploited Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML 95.7%
  • CVE-2026-59788 Medium 5.6 Stored XSS vulnerability in OAuth configuration form 0.3%
  • CVE-2026-59787 Medium 5.3 SNMP trap injection in zabbix_trap_receiver.pl 0.2%
  • CVE-2026-59786 Medium 6.9 Active agent heartbeat missing TLS check 0.2%
  • CVE-2026-59785 Medium 5.1 Hidden host credentials inferable via multiselect.get filtering 0.2%
  • CVE-2026-59783 Low 2.3 Server DoS via binary items 0.2%
  • CVE-2026-59782 Medium 6.9 JavaScript preprocessing memory disclosure 0.2%
  • CVE-2026-59781 Medium 5.4 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading. 0.2%
  • CVE-2026-23938 Low 2.1 Server DoS via JavaScript preprocessing or script items 0.5%
  • CVE-2026-23937 Medium 6.0 Host PSK extraction in Zabbix API 0.4%
  • CVE-2026-23935 Medium 6.8 Use-after-free read in script item/preprocessing HttpRequest body 0.5%
  • CVE-2026-23934 Medium 5.1 Frontend DoS via the validate.api.exists action 0.6%
  • CVE-2026-23933 High 7.7 Hardcoded session key in Zabbix 7.4 0.6%
  • CVE-2026-23931 Medium 5.3 Frontend plaintext macro value enumeration via the validatate.api.exists action 0.3%
  • CVE-2026-23930 Medium 5.3 Frontend DoS via the popup.testtriggerexpr action 0.6%
  • CVE-2026-23929 High 8.5 Prototype pollution leading to stored XSS 0.3%
  • CVE-2026-1199 Medium 6.9 API and Frontend login lockout race condition 0.2%
  • CVE-2026-23922 Low 2.1 Email media OAuth secret leak to Super Admin 0.4%
  • CVE-2026-23928 High 7.3 Stored XSS vulnerability in the Item history/Plain text widget 0.3%
  • CVE-2026-23927 Medium 5.1 Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter 0.2%
  • CVE-2026-23926 High 7.3 Stored XSS vulnerability in Host navigator widget maintenance tooltip 0.3%
  • CVE-2026-23924 Medium 6.1 Agent 2 Docker plugin arbitrary file read via Docker API injection 0.2%
  • CVE-2026-23923 Medium 6.9 Unauthenticated arbitrary PHP class instantiation 0.3%
  • CVE-2026-23921 High 8.7 Blind, read-only SQL injection in Zabbix API via sortfield parameter 4.1%
  • CVE-2026-23920 High 7.7 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection 0.3%
  • CVE-2026-23919 High 7.1 Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server 0.3%
  • CVE-2026-23925 Medium 5.1 Unauthorized host creation via configuration.import API by low-privilege user with write permissions 0.3%
  • CVE-2025-49643 Medium 6.0 Frontend DoS vulnerability due to asymmetric resource consumption 0.4%
  • CVE-2025-49642 Medium 5.8 Agent builds for AIX vulnerable to library loading hijacking 0.1%