Zimbra Collaboration

• CVE-2026-73570 High 8.9 Exploited A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitiz 71.7%
• CVE-2025-66376 High 7.2 Exploited Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. 20.2%
• CVE-2026-73576 Medium 6.3 In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure ra 0.3%
• CVE-2026-73575 Low 3.1 In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient val 0.2%
• CVE-2026-73574 Low 3.1 In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated at 0.3%
• CVE-2026-73573 Low 3.1 In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An auth 0.5%
• CVE-2026-73572 Medium 6.1 In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content 0.3%
• CVE-2026-73571 Low 3.1 An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker c 0.3%
• CVE-2025-62763 Medium 5.0 Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. 0.3%