zulip vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 20212
3. 202212
4. 20236
5. 20242
6. 20258
7. 202610

Newest CVEs

• CVE-2026-115474

  Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

  zulip · zulip

  Medium6.5
• CVE-2026-115574

  Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

  zulip · zulip

  Medium5.3
• CVE-2026-97701

  Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

  zulip · zulip

  Medium6.5
• CVE-2026-100404

  Zulip: Guests can read new messages in non-subscribed public channels

  zulip · zulip

  Medium6.5
• CVE-2026-102893

  Zulip: OpenID Connect authentication ignores the email_verified claim

  zulip · zulip

  Critical9.1
• CVE-2026-40300

  Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

  zulip · zulip

  Medium6.0
• CVE-2026-26058

  Zulip: Path Traversal in Import

  zulip · zulip

  Medium6.1
• CVE-2026-25742

  Zulip: Anonymous File Access After Disabling Spectator Access

  zulip · zulip

  Medium5.3
• CVE-2026-25741

  Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

  zulip · zulip

  High7.1
• CVE-2026-24050

  Zulip affected by Stored XSS in user profile modal

  zulip · zulip

  Low1.1