Known vulnerabilities in Zulip Server

Vendor: Zulip
Software: Zulip Server
Software CPE: cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 66
Public exploits: 2
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zulip Server Zulip Server is affected by 66 known vulnerabilities: 6 high, 26 medium, 34 low Critical High Medium Low

Vulnerabilities (66)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151560 - Missing Authorization
CWE-862 Low
No
No
12.3 22.09.2026 SB2026092223
#VU151561 - Improper Access Control
CWE-284 Low
No
No
12.3 22.09.2026 SB2026092223
#VU151559 - Improper Access Control
CWE-284 Low
No
No
12.3 22.09.2026 SB2026092223
#VU151558 - Improper Output Neutralization for Logs
CWE-117 Medium
No
No
12.3 22.09.2026 SB2026092223
#VU151557 - Improper Access Control
CWE-284 Low
No
No
12.3 22.09.2026 SB2026092223
#VU141414 - Improper Access Control
CWE-284 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141413 - Improper input validation
CWE-20 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141412 - Improper Authentication
CWE-287 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141411 - Improper Access Control
CWE-284 Low
No
No
12.2 11.08.2026 SB2026081129
#VU141410 - Improper Access Control
CWE-284 Medium
No
No
12.2 11.08.2026 SB2026081129
#VU127959 - Improper Access Control
CVE-2026-40300
CWE-284 Medium
Available
No
12.0 27.04.2026 SB2026042731
#VU126821 - Incorrect Authorization
CVE-2026-25741
CWE-863 Medium
No
No
- 22.04.2026 SB20260422177
#VU124765 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-26058
CWE-22 Medium
No
No
- 01.04.2026 SB2026040146
#VU124764 - Missing Authorization
CVE-2026-25742
CWE-862 Medium
No
No
- 01.04.2026 SB2026040146
#VU122423 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24050
CWE-79 Low
No
No
11.5 06.02.2026 SB2026020612
#VU112981 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-52559
CWE-79 Low
No
No
10.4 16.07.2025 SB20250716105
#VU109402 - Improper Access Control
CVE-2025-47930
CWE-284 Medium
No
No
10.3 19.05.2025 SB2025051909
#VU107580 - Improper Authentication
CVE-2025-31478
CWE-287 High
No
No
10.2 17.04.2025 SB2025041729
#VU106256 - Authorization Bypass Through User-Controlled SQL Primary Key
CVE-2025-30368
CWE-566 Low
No
No
10.1 31.03.2025 SB2025033108
#VU106255 - Authorization Bypass Through User-Controlled SQL Primary Key
CVE-2025-30369
CWE-566 Low
No
No
10.1 31.03.2025 SB2025033108


Showing elements 1 - 20 out of 66