Known vulnerabilities in Zulip Server

Vendor: Zulip
Software: Zulip Server
Software CPE: cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 61
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zulip Server Zulip Server is affected by 61 known vulnerabilities: 6 high, 25 medium, 30 low Critical High Medium Low

Vulnerabilities (61)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141414 - Improper Access Control
CWE-284 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141413 - Improper input validation
CWE-20 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141412 - Improper Authentication
CWE-287 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141411 - Improper Access Control
CWE-284 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141410 - Improper Access Control
CWE-284 Medium
No
No
12.2 11.08.2026 SB2026081129
#VU127959 - Improper Access Control
CVE-2026-40300
CWE-284 Medium
Available
No
12.0 27.04.2026 SB2026042731
#VU126821 - Incorrect Authorization
CVE-2026-25741
CWE-863 Medium
No
No
- 22.04.2026 SB20260422177
#VU124765 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-26058
CWE-22 Medium
No
No
- 01.04.2026 SB2026040146
#VU124764 - Missing Authorization
CVE-2026-25742
CWE-862 Medium
No
No
- 01.04.2026 SB2026040146
#VU122423 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24050
CWE-79 Low
No
No
11.5 06.02.2026 SB2026020612
#VU112981 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-52559
CWE-79 Low
No
No
10.4 16.07.2025 SB20250716105
#VU109402 - Improper Access Control
CVE-2025-47930
CWE-284 Medium
No
No
10.3 19.05.2025 SB2025051909
#VU107580 - Improper Authentication
CVE-2025-31478
CWE-287 High
No
No
10.2 17.04.2025 SB2025041729
#VU106256 - Authorization Bypass Through User-Controlled SQL Primary Key
CVE-2025-30368
CWE-566 Low
No
No
10.1 31.03.2025 SB2025033108
#VU106255 - Authorization Bypass Through User-Controlled SQL Primary Key
CVE-2025-30369
CWE-566 Low
No
No
10.1 31.03.2025 SB2025033108
#VU106254 - Exposure of sensitive information to an unauthorized actor
CVE-2025-27149
CWE-200 Low
No
No
10.0 31.03.2025 SB2025033107
#VU102877 - Exposure of sensitive information to an unauthorized actor
CVE-2024-56136
CWE-200 Medium
No
No
9.4 17.01.2025 SB2025011708
#VU87651 - Improper Access Control
CVE-2024-27286
CWE-284 Low
No
No
8.3 20.03.2024 SB2024032026
#VU86274 - Improper Privilege Management
CVE-2024-21630
CWE-269 Low
No
No
8.1 08.02.2024 SB2024020862
#VU83257 - Improper Access Control
CVE-2023-47642
CWE-284 Low
No
No
7.5 17.11.2023 SB2023111746


Showing elements 1 - 20 out of 61