| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-23938 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | An authenticated administrator is able to crash Zabbix server or proxy ... |
| CVE-2026-23937 | vulnerable | vulnerable (no DSA) | fixed | fixed | The Zabbix API host.get action can be exploited by authenticated users ... |
| CVE-2026-23935 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | A Zabbix administrator is able to read out of bounds memory by utilizi ... |
| CVE-2026-23930 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | An unauthenticated user is able to cause disproportionate CPU load on ... |
| CVE-2026-23929 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | Prototype pollution vulnerability in searchParamsToObject() is leading ... |
| CVE-2026-23928 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in ... |
| CVE-2026-23927 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A user able to connect to Agent 2 can inject an Oracle TNS connection ... |
| CVE-2026-23926 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | An authenticated (non-super) administrator can create a maintenance pe ... |
| CVE-2026-23925 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | An authenticated Zabbix user (User role) with template/host write perm ... |
| CVE-2026-23924 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.co ... |
| CVE-2026-23921 | vulnerable (no DSA) | fixed | fixed | fixed | A low privilege Zabbix user with API access can exploit a blind SQL in ... |
| CVE-2026-23920 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Host and event action script input is validated with a regex (set by t ... |
| CVE-2026-23919 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape ... |
| CVE-2026-1199 | vulnerable (no DSA, ignored) | vulnerable (no DSA, ignored) | fixed | fixed | Zabbix API and Frontend login lockout mechanism has a flaw where sever ... |
| CVE-2025-49643 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | An authenticated Zabbix user (including Guest) is able to cause dispro ... |
| CVE-2025-49641 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A regular Zabbix user with no permission to the Monitoring -> Problems ... |
| CVE-2025-27240 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval ... |
| CVE-2025-27236 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A regular Zabbix user can search other users in their user group via Z ... |
| CVE-2025-27233 | vulnerable (no DSA) | fixed | fixed | fixed | Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.g ... |
| CVE-2025-27231 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The LDAP 'Bind password' value cannot be read after saving, but a Supe ... |
| CVE-2024-45700 | vulnerable (no DSA) | fixed | fixed | fixed | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled ... |
| CVE-2024-45699 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross- ... |
| CVE-2024-42333 | vulnerable (no DSA) | fixed | fixed | fixed | The researcher is showing that it is possible to leak a small amount o ... |
| CVE-2024-42332 | vulnerable (no DSA) | fixed | fixed | fixed | The researcher is showing that due to the way the SNMP trap log is par ... |
| CVE-2024-42331 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | In the src/libs/zbxembed/browser.c file, the es_browser_ctor method re ... |
| CVE-2024-42330 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The HttpRequest object allows to get the HTTP headers from the server' ... |
| CVE-2024-42327 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A non-admin user account on the Zabbix frontend with the default User ... |
| CVE-2024-42325 | vulnerable (no DSA) | fixed | fixed | fixed | Zabbix API user.get returns all users that share common group with the ... |
| CVE-2024-36469 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Execution time for an unsuccessful login differs when using a non-exis ... |
| CVE-2024-36467 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | An authenticated user with API access (e.g.: user with default User ro ... |
| CVE-2024-36466 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A bug in the code allows an attacker to sign a forged zbx_session cook ... |
| CVE-2024-36464 | vulnerable (no DSA) | fixed | fixed | fixed | When exporting media types, the password is exported in the YAML in pl ... |
| CVE-2024-36463 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The implementation of atob in "Zabbix JS" allows to create a string wi ... |
| CVE-2024-36461 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Within Zabbix, users have the ability to directly modify memory pointe ... |
| CVE-2024-36460 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The front-end audit log allows viewing of unprotected plaintext passwo ... |
| CVE-2024-22123 | vulnerable (no DSA) | fixed | fixed | fixed | Setting SMS media allows to set GSM modem file. Later this file is use ... |
| CVE-2024-22122 | vulnerable (no DSA) | fixed | fixed | fixed | Zabbix allows to configure SMS notifications. AT command injection occ ... |
| CVE-2024-22120 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Zabbix server can perform command execution for configured scripts. Af ... |
| CVE-2024-22119 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The cause of vulnerability is improper validation of form input field ... |
| CVE-2024-22117 | vulnerable (no DSA) | fixed | fixed | fixed | When a URL is added to the map element, it is recorded in the database ... |
| CVE-2024-22116 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | An administrator with restricted permissions can exploit the script ex ... |
| CVE-2024-22114 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | User with no permission to any of the Hosts can access and view host c ... |
| CVE-2023-32728 | vulnerable (no DSA) | fixed | fixed | fixed | The Zabbix Agent 2 item key smart.disk.get does not sanitize its param ... |
| CVE-2023-32727 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | An attacker who has the privilege to configure Zabbix items can use fu ... |
| CVE-2023-32726 | vulnerable (no DSA) | fixed | fixed | fixed | The vulnerability is caused by improper check for check if RDLENGTH do ... |
| CVE-2023-32725 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | The website configured in the URL widget will receive a session cookie ... |
| CVE-2023-32724 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Memory pointer is in a property of the Ducktape object. This leads to ... |
| CVE-2023-32722 | vulnerable (no DSA) | fixed | fixed | fixed | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow ... |
| CVE-2023-32721 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | A stored XSS has been found in the Zabbix web application in the Maps ... |
| CVE-2023-29458 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on ... |
| CVE-2023-29457 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Reflected XSS attacks, occur when a malicious script is reflected off ... |
| CVE-2023-29456 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | URL validation scheme receives input from a user and then parses it to ... |
| CVE-2023-29455 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Reflected XSS attacks, also known as non-persistent attacks, occur whe ... |
| CVE-2023-29454 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Stored or persistent cross-site scripting (XSS) is a type of XSS where ... |
| CVE-2023-29452 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | Currently, geomap configuration (Administration -> General -> Geograph ... |
| CVE-2023-29451 | vulnerable (no DSA) | fixed | fixed | fixed | Specially crafted string can cause a buffer overrun in the JSON parser ... |
| CVE-2023-29450 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | JavaScript pre-processing can be used by the attacker to gain access t ... |
| CVE-2023-29449 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | JavaScript preprocessing, webhooks and global scripts can cause uncont ... |
| Bug | Description |
|---|
| TEMP-0391388-A7E978 | zabbix format string vulnerabilities |
| TEMP-0391388-8371AD | zabbix buffer overflows |
| CVE-2026-59781 | When Zabbix Agent was installed on Windows into a custom installation ... |
| CVE-2026-23934 | An authenticated user is able to cause disproportionate CPU load on th ... |
| CVE-2026-23933 | In Zabbix 7.4 the cryptographic key used for signing Frontend sessions ... |
| CVE-2026-23931 | The frontend validatate.api.exists action can be exploited by authenti ... |
| CVE-2026-23923 | An unauthenticated attacker can exploit the Frontend 'validate' action ... |
| CVE-2026-23922 | The email media OAuth field 'Client secret' cannot be read after savin ... |
| CVE-2025-49642 | Library loading on AIX Zabbix Agent builds can be hijacked by local us ... |
| CVE-2025-27238 | Due to a bug in Zabbix API, the hostprototype.get method lists all hos ... |
| CVE-2025-27237 | In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file ... |
| CVE-2025-27234 | Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.g ... |
| CVE-2025-27232 | An authenticated Zabbix Super Admin can exploit the oauth.authorize ac ... |
| CVE-2024-42329 | The webdriver for the Browser object expects an error object to be ini ... |
| CVE-2024-42328 | When the webdriver for the Browser object downloads data from a HTTP s ... |
| CVE-2024-42326 | There was discovered a use after free bug in browser.c in the es_brows ... |
| CVE-2024-36468 | The reported vulnerability is a stack buffer overflow in the zbx_snmp_ ... |
| CVE-2024-36465 | A low privilege (regular) Zabbix user with API access can use SQL inje ... |
| CVE-2024-36462 | Uncontrolled resource consumption refers to a software vulnerability w ... |
| CVE-2024-22121 | A non-admin user can change or remove important features within the Za ... |
| CVE-2023-32723 | Request to LDAP is sent before user permissions are checked. |
| CVE-2022-46768 | Arbitrary file read vulnerability exists in Zabbix Web Service Report ... |
| CVE-2022-43516 | A Firewall Rule which allows all incoming TCP connections to all progr ... |
| CVE-2022-43515 | Zabbix Frontend provides a feature that allows admins to maintain the ... |
| CVE-2022-40626 | An unauthenticated user can create a link with reflected Javascript co ... |
| CVE-2022-35230 | An authenticated user can create a link with reflected Javascript code ... |
| CVE-2022-35229 | An authenticated user can create a link with reflected Javascript code ... |
| CVE-2022-24919 | An authenticated user can create a link with reflected Javascript code ... |
| CVE-2022-24918 | An authenticated user can create a link with reflected Javascript code ... |
| CVE-2022-24917 | An authenticated user can create a link with reflected Javascript code ... |
| CVE-2022-24349 | An authenticated user can create a link with reflected XSS payload for ... |
| CVE-2022-23134 | After the initial setup process, some steps of setup.php file are reac ... |
| CVE-2022-23133 | An authenticated user can create a hosts group from the configuration ... |
| CVE-2022-23132 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability i ... |
| CVE-2022-23131 | In the case of instances where the SAML SSO authentication is enabled ... |
| CVE-2021-27927 | In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5 ... |
| CVE-2020-15803 | Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x bef ... |
| CVE-2020-11800 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote att ... |
| CVE-2019-17382 | An issue was discovered in zabbix.php?action=dashboard.view&dashboardi ... |
| CVE-2019-15132 | Zabbix through 4.4.0alpha1 allows User Enumeration. With login request ... |
| CVE-2017-2826 | An information disclosure vulnerability exists in the iConfig proxy re ... |
| CVE-2017-2825 | In the trapper functionality of Zabbix Server 2.4.x, specifically craf ... |
| CVE-2017-2824 | An exploitable code execution vulnerability exists in the trapper comm ... |
| CVE-2016-10742 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before ... |
| CVE-2016-10134 | SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0 ... |
| CVE-2016-4338 | The mysql user parameter configuration script (userparameter_mysql.con ... |
| CVE-2014-9450 | Multiple SQL injection vulnerabilities in chart_bar.php in the fronten ... |
| CVE-2014-3005 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21r ... |
| CVE-2014-1685 | The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2 ... |
| CVE-2014-1682 | The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x ... |
| CVE-2013-7484 | Zabbix before 5.0 represents passwords in the users table with unsalte ... |
| CVE-2013-6824 | Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 ... |
| CVE-2013-5743 | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc ... |
| CVE-2013-5572 | Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bi ... |
| CVE-2013-3738 | A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequat ... |
| CVE-2013-1364 | The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc ... |
| CVE-2012-6086 | libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x befo ... |
| CVE-2012-3435 | SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix ... |
| CVE-2011-5027 | Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allow ... |
| CVE-2011-4674 | SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, an ... |
| CVE-2011-4615 | Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1 ... |
| CVE-2011-3265 | popup.php in Zabbix before 1.8.7 allows remote attackers to read the c ... |
| CVE-2011-3264 | Zabbix before 1.8.6 allows remote attackers to obtain sensitive inform ... |
| CVE-2011-3263 | zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows con ... |
| CVE-2011-2904 | Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix befor ... |
| CVE-2010-5049 | SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier ... |
| CVE-2010-2790 | Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery ... |
| CVE-2010-1277 | SQL injection vulnerability in the user.authenticate method in the API ... |
| CVE-2009-4502 | The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, whe ... |
| CVE-2009-4501 | The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Serv ... |
| CVE-2009-4500 | The process_trap function in trapper/trapper.c in Zabbix Server before ... |
| CVE-2009-4499 | SQL injection vulnerability in the get_history_lastid function in the ... |
| CVE-2009-4498 | The node_process_command function in Zabbix Server before 1.8 allows r ... |
| CVE-2008-7220 | Unspecified vulnerability in Prototype JavaScript framework (prototype ... |
| CVE-2008-1353 | zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denia ... |
| CVE-2007-6210 | zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" script ... |
| CVE-2007-0640 | Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack v ... |
| CVE-2006-6693 | Multiple buffer overflows in zabbix before 20061006 allow attackers to ... |
| CVE-2006-6692 | Multiple format string vulnerabilities in zabbix before 20061006 allow ... |