Oopenziti

Products

Exploited and recent CVEs

• CVE-2026-45576 High 8.3 zrok copy writes attacker-controlled WebDAV paths outside the destination root 0.5%
• CVE-2026-45568 Critical 9.9 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths 0.5%
• CVE-2026-58165 High 8.8 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation 0.3%
• CVE-2026-42275 High 8.7 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write 0.3%
• CVE-2026-40304 Medium 5.3 zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records 0.3%
• CVE-2026-40303 High 7.5 zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing 0.5%
• CVE-2026-40302 Medium 6.1 zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering 0.2%
• CVE-2025-27501 High 8.6 Server Side Request Forgery in Ziti Console 0.4%
• CVE-2025-27500 High 8.2 Cross Site Scripting potential in Ziti Console 0.3%