Known vulnerabilities in Zimbra Collaboration

Vendor: Synacor Inc.
Software: Zimbra Collaboration
Software CPE: cpe:2.3:a:synacor:zimbra_collaboration:*:*:*:*:*:*:*:*
Website: https://www.zimbra.com/
Total vulnerabilities: 116
Public exploits: 11
Known exploited (KEV): 17
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zimbra Collaboration Zimbra Collaboration is affected by 116 known vulnerabilities: 4 critical, 17 high, 69 medium, 26 low Critical High Medium Low

Vulnerabilities (116)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144519 - Command injection
CVE-2026-73570		 CWE-77 Critical
No
Exploited
 10.1.20 21.08.2026 SB2026082146
#VU144520 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144521 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144522 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144523 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144524 - Improper Access Control
CVE-2026-50055		 CWE-284 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144525 - Improper Access Control
CVE-2026-10631		 CWE-284 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144526 - Incorrect Authorization
CVE-2026-50054		 CWE-863 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU144527 - Server-Side Request Forgery (SSRF)
 CWE-918 Low
No
No
 10.1.20 21.08.2026 SB2026082146
#VU136998 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 High
No
No
 10.1.19 07.07.2026 SB2026070755
#VU134806 - Improper Authorization
 CWE-285 Low
No
No
 10.1.17 18.06.2026 SB2026061826
#VU134807 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 10.1.17 18.06.2026 SB2026061826
#VU134808 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 Low
No
No
 10.1.17 18.06.2026 SB2026061826
#VU134809 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 Medium
No
No
 10.1.17 18.06.2026 SB2026061826
#VU134810 - Cross-Site Request Forgery (CSRF)
 CWE-352 Medium
No
No
 10.1.17 18.06.2026 SB2026061826
#VU134811 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
 CWE-338 Medium
No
No
 10.1.17 18.06.2026 SB2026061826
#VU133362 - Resource exhaustion
CVE-2026-49975		 CWE-400 High
No
No
 10.1.18 04.06.2026 SB2026060491
SB2026060492
SB2026060493
and 30 more
#VU118167 - Cross-Site Request Forgery (CSRF)
CVE-2026-33373		 CWE-352 Medium
No
No
 10.0.18, 10.1.13 06.11.2025 SB2025110653
#VU118166 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 Medium
No
No
 10.0.18, 10.1.13 06.11.2025 SB2025110653
#VU118165 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-66376		 CWE-79 Medium
No
Exploited
 10.0.18, 10.1.13 06.11.2025 SB2025110653


Showing elements 1 - 20 out of 116