Zabbix vulnerabilities

CVEs per yearBy the year they were published

1. 20171
2. 20201
3. 202214
4. 202318
5. 202511
6. 202529
7. 202626

Known exploitedNewest addition to KEV first

• CVE-2022-23134

  Possible view of the setup pages by unauthenticated users if config file already exists

  Zabbix · Frontend

  ExploitedLow3.7
• CVE-2022-23131

  Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

  Zabbix · Frontend

  ExploitedCritical9.1

Newest CVEs

• CVE-2026-59788

  Stored XSS vulnerability in OAuth configuration form

  Zabbix · Zabbix

  Medium5.6
• CVE-2026-59787

  SNMP trap injection in zabbix_trap_receiver.pl

  Zabbix · Zabbix

  Medium5.3
• CVE-2026-59786

  Active agent heartbeat missing TLS check

  Zabbix · Zabbix

  Medium6.9
• CVE-2026-59785

  Hidden host credentials inferable via multiselect.get filtering

  Zabbix · Zabbix

  Medium5.1
• CVE-2026-59783

  Server DoS via binary items

  Zabbix · Zabbix

  Low2.3
• CVE-2026-59782

  JavaScript preprocessing memory disclosure

  Zabbix · Zabbix

  Medium6.9
• CVE-2026-59781

  Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

  Zabbix · Zabbix

  Medium5.4
• CVE-2026-23938

  Server DoS via JavaScript preprocessing or script items

  Zabbix · Zabbix

  Low2.1
• CVE-2026-23937

  Host PSK extraction in Zabbix API

  Zabbix · Zabbix

  Medium6.0
• CVE-2026-23935

  Use-after-free read in script item/preprocessing HttpRequest body

  Zabbix · Zabbix

  Medium6.8