https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67809.htmlhttps://patchthecve.com/cve/CVE-2025-67809.htmlWed, 14 Oct 2026 17:10:00 +0000MEDIUM 4.7: An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and https://patchthecve.com/cve/CVE-2024-45515.htmlhttps://patchthecve.com/cve/CVE-2024-45515.htmlWed, 17 Jun 2026 07:54:21 +0000MEDIUM 6.1: An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipuhttps://patchthecve.com/cve/CVE-2025-27914.htmlhttps://patchthecve.com/cve/CVE-2025-27914.htmlWed, 17 Jun 2026 09:04:22 +0000MEDIUM 5.4: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth tokehttps://patchthecve.com/cve/CVE-2024-9665.htmlhttps://patchthecve.com/cve/CVE-2024-9665.htmlWed, 17 Jun 2026 08:25:00 +0000MEDIUM 6.5: Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email https://patchthecve.com/cve/CVE-2024-33536.htmlhttps://patchthecve.com/cve/CVE-2024-33536.htmlWed, 17 Jun 2026 07:31:56 +0000MEDIUM 5.4: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading https://patchthecve.com/cve/CVE-2024-33535.htmlhttps://patchthecve.com/cve/CVE-2024-33535.htmlWed, 17 Jun 2026 07:31:56 +0000HIGH 7.5: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authhttps://patchthecve.com/cve/CVE-2024-33533.htmlhttps://patchthecve.com/cve/CVE-2024-33533.htmlWed, 17 Jun 2026 07:31:56 +0000MEDIUM 5.4: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenhttps://patchthecve.com/cve/CVE-2024-27443.htmlhttps://patchthecve.com/cve/CVE-2024-27443.htmlWed, 17 Jun 2026 07:19:54 +0000MEDIUM 6.1: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this https://patchthecve.com/cve/CVE-2024-27442.htmlhttps://patchthecve.com/cve/CVE-2024-27442.htmlWed, 17 Jun 2026 07:19:54 +0000HIGH 7.8: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of https://patchthecve.com/cve/CVE-2023-50808.htmlhttps://patchthecve.com/cve/CVE-2023-50808.htmlWed, 17 Jun 2026 06:39:59 +0000MEDIUM 6.1: Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.https://patchthecve.com/cve/CVE-2023-48432.htmlhttps://patchthecve.com/cve/CVE-2023-48432.htmlWed, 17 Jun 2026 06:34:14 +0000MEDIUM 6.1: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.https://patchthecve.com/cve/CVE-2023-45207.htmlhttps://patchthecve.com/cve/CVE-2023-45207.htmlWed, 17 Jun 2026 06:28:27 +0000MEDIUM 6.1: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising thhttps://patchthecve.com/cve/CVE-2023-45206.htmlhttps://patchthecve.com/cve/CVE-2023-45206.htmlWed, 17 Jun 2026 06:28:26 +0000MEDIUM 6.1: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)https://patchthecve.com/cve/CVE-2023-26562.htmlhttps://patchthecve.com/cve/CVE-2023-26562.htmlWed, 17 Jun 2026 05:43:36 +0000MEDIUM 6.5: In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.