https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-73576.htmlhttps://patchthecve.com/cve/CVE-2026-73576.htmlFri, 28 Aug 2026 13:08:02 +0000MEDIUM 6.3: In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with https://patchthecve.com/cve/CVE-2026-73575.htmlhttps://patchthecve.com/cve/CVE-2026-73575.htmlFri, 28 Aug 2026 13:17:11 +0000LOW 3.1: In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authentichttps://patchthecve.com/cve/CVE-2026-73574.htmlhttps://patchthecve.com/cve/CVE-2026-73574.htmlFri, 28 Aug 2026 13:49:17 +0000LOW 3.1: In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorizedhttps://patchthecve.com/cve/CVE-2026-73573.htmlhttps://patchthecve.com/cve/CVE-2026-73573.htmlFri, 28 Aug 2026 13:54:52 +0000LOW 3.1: In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, pohttps://patchthecve.com/cve/CVE-2026-73572.htmlhttps://patchthecve.com/cve/CVE-2026-73572.htmlFri, 28 Aug 2026 13:57:50 +0000MEDIUM 6.1: In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, https://patchthecve.com/cve/CVE-2026-73571.htmlhttps://patchthecve.com/cve/CVE-2026-73571.htmlFri, 28 Aug 2026 13:58:23 +0000LOW 3.1: An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessihttps://patchthecve.com/cve/CVE-2026-73570.htmlhttps://patchthecve.com/cve/CVE-2026-73570.htmlMon, 24 Aug 2026 13:19:17 +0000HIGH 8.9: A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send s