IceWhaleTech ZimaOS vulnerabilities

CVEs per yearBy the year they were published

1. 20245
2. 20252
3. 20265

Newest CVEs

• CVE-2026-28798

  Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS

  IceWhaleTech · ZimaOS

  Critical9.1
• CVE-2026-28442

  ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation

  IceWhaleTech · ZimaOS

  High8.6
• CVE-2025-64427

  ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)

  IceWhaleTech · ZimaOS

  High7.1
• CVE-2026-28286

  ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

  IceWhaleTech · ZimaOS

  High8.6
• CVE-2026-21891

  ZimaOS has Authentication Bypass via System-Level Username

  IceWhaleTech · ZimaOS

  Critical9.4
• CVE-2025-58432

  ZimaOS Privilege Escalation using localhost calls to File API Upload

  IceWhaleTech · ZimaOS

  Medium5.2
• CVE-2025-58431

  ZimaOS reads arbitrary files using localhost calls to File API Download

  IceWhaleTech · ZimaOS

  Medium4.8
• CVE-2024-49359

  ZimaOS vulnerable to Directory Listing via Parameter Manipulation

  IceWhaleTech · ZimaOS

  High7.5
• CVE-2024-49358

  ZimaOS vulnerable to Username Enumeration via API Responses

  IceWhaleTech · ZimaOS

  Medium5.3
• CVE-2024-49357

  ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

  IceWhaleTech · ZimaOS

  High7.5