Known vulnerabilities in ZoneMinder - page 4

Vendor: ZoneMinder.com
Software: ZoneMinder
Software CPE: cpe:2.3:a:zoneminder_com:zoneminder:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 75
Public exploits: 7
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ZoneMinder ZoneMinder is affected by 75 known vulnerabilities: 17 high, 25 medium, 33 low Critical High Medium Low

Vulnerabilities (75)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU158967 - Authentication Bypass by Spoofing
 CWE-290 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158965 - Missing Authorization
 CWE-862 Low
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158966 - Information Exposure Through Log Files
 CWE-532 Low
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158964 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
 CWE-89 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158963 - Authorization Bypass Through User-Controlled Key
 CWE-639 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158962 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158961 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158960 - Stack-based buffer overflow
 CWE-121 High
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158959 - Server-Side Request Forgery (SSRF)
 CWE-918 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158958 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158957 - Incorrect Authorization
 CWE-863 Low
No
No
 1.38.5 03.11.2026 SB2026100655
#VU158955 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 High
No
No
 - 03.11.2026 SB2026110388
#VU158951 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.36.36, 1.37.74 03.11.2026 SB2026110390
#VU158950 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Medium
No
No
 1.39.2 03.11.2026 SB2026110389
#VU158948 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Medium
No
No
 1.39.2 03.11.2026 SB2026110389


Showing elements 61 - 80 out of 75