Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.8	CVE-2026-93640	A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93640A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges Executive summary The advisory describes a local privilege escalation flaw in the optional dnscache package of Zimbra Collaboration Suite, which lets the zimbra Unix account reach files with root privileges. The advisory text provided does not state a severity rating or CVSS score for this specific flaw. The vendor's recommendation given in the text is to update Zimbra using yum or apt and to move to the latest release. Technical summary The flaw is a local privilege escalation in the optional dnscache package, allowing the local zimbra account to access files with root privileges. The attack requires local access as the zimbra account; the advisory does not state the exact preconditions or exploit details. Affected versions and the fixed version for this specific CVE are not stated in the provided text, and no workaround is stated. The surrounding Zimbra advisory table lists many other fixes by release but does not map CVE-2026-93640 to a fix release. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-93639	A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93639A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet... Executive summary A missing authorization flaw in Zimbra Collaboration Suite (ZCS) lets a delegated administrator who has no explicit administrative grants overwrite global Zimlets. The advisory text provided is cut off, so its severity rating is not stated. The fix version and vendor recommendation for this specific CVE are not stated in the provided text. Technical summary The flaw is a missing authorization check (vulnerability class not further specified) that lets a delegated administrator with no explicit administrative grants overwrite global Zimlets in Zimbra Collaboration Suite. The attack requires a delegated administrator account, and the advisory does not say what other preconditions apply. Affected versions, fixed versions, CVSS score, and workarounds are not stated in the provided text. Exploitation in the wild and detection guidance are not stated. The surrounding Zimbra security page lists fixes for other CVEs by release, but none of those entries is confirmed here as relating to CVE-2026-93639. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.1	CVE-2026-93638	A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93638A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the... Executive summary The advisory says the Zimbra Collaboration Suite (ZCS) login page has a reflected cross-site scripting flaw that lets an unauthenticated attacker run JavaScript. The advisory does not state a severity score for this CVE, and it does not name a fixed version for it. The linked Zimbra page recommends updating to the latest release. Technical summary The flaw is a reflected cross-site scripting (XSS) issue in the ZCS login page, and the text is cut off before it explains the exact injection point. An unauthenticated attacker can cause JavaScript to run, which implies a victim must be lured to a crafted link, but the advisory excerpt does not state this detail. Affected versions are not stated for this CVE. The CVSS score is not stated, and no fixed version is listed for this CVE in the excerpt. The linked Zimbra security page lists fixes for many other CVEs in releases such as 10.1.21, but it does not map them to CVE-2026-93638. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93636	An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93636An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through... Executive summary A flaw in Zimbra Collaboration Suite (ZCS) lets a logged-in user see calendar resource details that the system normally does not return. The advisory text is cut off, and it does not state a severity rating for this specific issue. It also does not state a vendor fix or recommended action for this CVE. Technical summary The advisory describes an LDAP filter injection vulnerability in ZCS that lets an authenticated user query otherwise unreturned attributes of calendar resources. The text is truncated at the point where it describes the attack path, so the exact request method and preconditions beyond authentication are not stated. Affected versions are not stated for this CVE, and no fixed version is given in the excerpt. No CVSS score or other severity rating is stated, and no workaround, exploitation status, or detection guidance is stated. The surrounding Zimbra security page lists a different LDAP injection fix (CVE-2026-33369) and does not clearly tie its entries to this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93634	A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox... Executive summary The advisory describes a cross-account authorization flaw in Zimbra Collaboration Suite that lets an authenticated user insert forged shared-file records into another user's mailbox. The advisory page is a long list of fixed issues, and the text does not give a single overall severity for CVE-2026-93634 itself. Customers are directed to update Zimbra using yum or apt and to the latest release from the Zimbra download page. Technical summary The flaw is an authorization issue (cross-account) in Zimbra Collaboration Suite that allows an authenticated user to insert forged shared-file records into another user's mailbox. The advisory text provided is truncated and does not describe the attack steps in detail, so the exact preconditions beyond authentication are not stated. Affected version ranges and CVSS score for CVE-2026-93634 are not stated in the supplied text. The page lists fixes in 10.1.21, 10.1.20, and other releases for different issues, but no fixed version is explicitly tied to CVE-2026-93634. No workaround or detection guidance for this CVE is stated. Operators should check the Zimbra Security Advisories page and the blog feed for the specific fixed release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.4	CVE-2026-93633	A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled... Executive summary The advisory covers a Zimbra Collaboration Suite (ZCS) advisory page listing many security fixes, including a CSS sanitization flaw that lets an authenticated user with Briefcase access publish a document that displays attacker-controlled content. The advisory text provided is truncated and does not give a severity rating for this specific CVE, and it does not state a CVSS score for CVE-2026-93633. The vendor recommends updating Zimbra using the normal package update process and moving to the latest release. Technical summary The flaw is described as a CSS sanitization vulnerability in Zimbra Collaboration Suite that allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content. The attack requires a valid authenticated account with Briefcase access. The advisory text is truncated, so the affected version range and the fixed version for CVE-2026-93633 are not stated. No workaround or detection guidance for this CVE is stated, and no exploitation status is stated. The surrounding Zimbra advisory table lists fixes in release 10.1.21 and earlier releases, but it does not explicitly map CVE-2026-93633 to a specific fix release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.1	CVE-2026-93631	A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93631A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external... Executive summary The advisory describes CVE-2026-93631, a cross-site request forgery flaw in the OAuth extension of Zimbra Collaboration Suite Network Edition that lets an attacker link an attacker-controlled external account. The text is cut off, so the advisory does not state a severity rating for this CVE within the provided text. The vendor's recommendation shown here is to update Zimbra using the latest release and patches, though no specific fixed version is given for this CVE. Technical summary The flaw is a cross-site request forgery in the OAuth extension, which lets an attacker link an attacker-controlled external account, per the truncated description. The attack vector and preconditions beyond this are not stated. The affected versions are not stated, and the fixed version for CVE-2026-93631 is not stated in the provided text. The advisory does not give a CVSS score for this CVE, and no workaround or detection guidance for it is stated. The rest of the page is a general Zimbra security table that does not clearly map to this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zimbra Zimbra Collaboration Suite Network Edition Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93630	A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93630A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms... Executive summary The advisory says a flaw in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) lets an unauthenticated sender bypass a restriction on forms. The text is cut off, so its severity rating and the exact impact are not stated. The page it came from recommends updating Zimbra to the latest release using yum or apt, but it does not tie that step to this specific CVE. Technical summary The advisory describes a hostname canonicalization vulnerability in the email HTML sanitizers of ZCS, and the description is cut off mid-sentence after mentioning a bypass of a restriction on forms. An unauthenticated sender can trigger it by sending email, and the advisory does not say what other preconditions apply. Affected versions, fixed versions, CVSS score, and workarounds for CVE-2026-93630 are not stated in the text provided. No detection guidance or exploitation status is given for this CVE. The page also contains a large table of other Zimbra fixes, but those entries do not mention CVE-2026-93630 and are not used for this summary. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93629	An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93629An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user Executive summary The advisory is a CVE record for Zimbra Collaboration Suite (ZCS) describing an organizer authentication flaw that lets an unauthenticated email sender insert calendar invitations attributed to another user. The advisory text does not state a severity score for this CVE, and the vendor's fix guidance for it is not clearly stated in the excerpt provided. Defenders should check Zimbra's security advisory page for the patched release. Technical summary The flaw is an organizer authentication issue in the calendar invitation handling of Zimbra Collaboration Suite, allowing an unauthenticated sender to make an invite appear to come from another user. The advisory excerpt does not state the attack vector details beyond sending email, the affected version range, or a CVSS score for this CVE. The excerpt is a broad Zimbra security advisory listing many other CVEs, and none of its rows explicitly map to this CVE, so the fixed version for this specific issue is not stated. No workaround or detection guidance for this issue is stated. Operators should confirm affected versions and fixes against the vendor's release notes before acting. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93628	An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93628An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's... Executive summary The advisory describes an attendee authentication flaw in the email calendar processing of Zimbra Collaboration Suite (ZCS), which lets an unauthenticated sender forge another attendee's identity. The advisory text is cut off, so its stated severity and full details are not available. The fetched page is a Zimbra security advisory listing many fixes, and it recommends updating Zimbra using yum update or apt update. Technical summary The flaw is described as an attendee authentication vulnerability in email calendar processing that allows an unauthenticated sender to forge another attendee's identity. The advisory text is truncated, so the full description, CVSS score, and attack details are not stated. No affected version range or fixed version for this specific CVE is stated in the excerpt provided. No workaround or detection guidance for this CVE is stated. The rest of the page is a general Zimbra security table listing other CVEs with fix versions such as 10.1.21, which are not clearly tied to this CVE in the excerpt. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93627	An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing... Apache, PHP, OpenSSLPHP, OpenSSL, electron, Zimbra Collaboration Suite, Apache CXF, Zimbra Desktop, Zimbra Modern Zimbra Desktop, OpenJDK, ClamAV, NGINX, Rsync, Apache HttpClient, Spring Core, Cyrus SASL, Jetty, Perl Compress::Zlib, electron graphiql, TinyMCE, @babel/runtime	NVD	Oct 23 14:17 UTC
CVE-2026-93627An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing... Executive summary The advisory is a Zimbra Collaboration Suite security advisory listing many fixed vulnerabilities, including cross-site scripting, authorization flaws, file inclusion, and command injection issues across multiple releases. The advisory does not describe one single severity level for the set, and most entries have no CVSS score stated. The vendor recommends updating Zimbra to the latest release or patch using yum or apt update. Technical summary The advisory covers a large batch of fixes spanning cross-site scripting, CSRF, SSRF, local and remote file inclusion, XXE, LDAP injection, authorization bypasses, and a command injection in the SNMP monitoring component, among others. Attack vectors and preconditions vary by entry; some require authentication and others are unauthenticated, as noted in individual entries. Fixed versions are listed as written in the table, such as 10.1.21, 10.1.20, 10.1.17, 10.1.16, and older patch levels like 9.0.0 Patch 46, 10.0.15, and 10.1.9. Most entries have CVSS scores listed as TBD, and some have none. The advisory does not state workarounds for most entries, and it gives no detection guidance beyond upgrading. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Apache Apache HTTP Server Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Apache PHP OpenSSL electron Zimbra OpenJDK ClamAV Nginx Rsync Spring Cyrus SASL Jetty Perl TinyMCE @babel PHP OpenSSL electron Zimbra Collaboration Suite Apache CXF Zimbra Desktop Zimbra Modern Zimbra Desktop OpenJDK ClamAV NGINX Rsync Apache HttpClient Spring Core Cyrus SASL Jetty Perl Compress::Zlib electron graphiql TinyMCE @babel/runtime NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.8	CVE-2026-50057	A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50057A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root Executive summary The advisory describes a local privilege escalation flaw in the Zimbra Collaboration Suite MTA package, where the Unix zimbra account can run arbitrary commands as root. The advisory text is a long Zimbra security table and does not state a severity rating or CVSS score for this specific flaw, and it does not state a clear vendor recommendation for it beyond general advice to update to the latest release. Technical summary The flaw is described as local privilege escalation in the ZCS MTA package, allowing the Unix zimbra account to execute arbitrary commands as root. The advisory does not state the attack preconditions beyond requiring local access as the zimbra account, and it does not give affected or fixed version numbers for this specific flaw. No CVSS score, workaround, or exploitation status for CVE-2026-50057 is stated. The advisory points to a general Zimbra update via yum or apt and to the latest download page, but gives no specific fixed build for this issue. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.8	CVE-2026-50056	A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50056A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root Executive summary The advisory describes a local privilege escalation flaw in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS). It lets the Unix zimbra account run arbitrary commands as root. The advisory does not state a severity score for this specific flaw, and the page is a broad list of Zimbra fixes that does not give specific remediation steps for it beyond general advice to update to the latest release. Technical summary The flaw is a local privilege escalation in the zmmailboxdmgr launcher, allowing a local user holding the Unix zimbra account to execute arbitrary commands as root. The advisory text does not state a CVSS score, the affected version range, or the fixed version for this CVE-2026-50056 entry. Attack complexity and required preconditions beyond local access to the zimbra account are not stated. No workaround or detection guidance specific to this flaw is stated. The surrounding Zimbra page recommends updating via yum or apt to the latest release, but the specific fixed release for this CVE is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-50053	A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50053A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted... Executive summary The advisory is a Zimbra Collaboration Suite security advisory page that lists many fixed vulnerabilities across recent releases. The specific CVE-2026-50053 entry (request attribute override on /h/* endpoints) is described only in a truncated opening line, and the advisory does not state its severity score. The vendor recommends updating Zimbra to the latest release through its normal update channel. Technical summary The truncated description says unauthenticated requests to /h/* can populate servlet attributes intended for trusted internal use, which is a request attribute override class of flaw. The text does not state the attack preconditions in full, a CVSS score, affected version ranges, or the fixed version for CVE-2026-50053 itself. No workaround or detection guidance is given for this CVE. The page lists fixes in ZCS 10.1.21, 10.1.20 and earlier releases, but none of these entries is explicitly tied to CVE-2026-50053. Defenders should check the Zimbra blog and vendor patch notes for the exact fixed build. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-115786	A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and... Apache, PHP, OpenSSLPHP, OpenSSL, electron, Zimbra Collaboration Suite, Apache CXF, Zimbra Desktop, Zimbra Modern Zimbra Desktop, OpenJDK, ClamAV, NGINX, Rsync, Apache HttpClient, Spring Core, Cyrus SASL, Jetty, TinyMCE, Apache Log4j	NVD	Oct 23 14:17 UTC
CVE-2026-115786A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and... Executive summary The advisory describes a mailbox quota accounting flaw in Zimbra Collaboration Suite (ZCS) that lets an authenticated user consume another user's mailbox quota by repeatedly sharing items. The text also lists a long set of Zimbra fixes, many with unscored issues, and the advisory does not state a severity rating for the quota flaw. The vendor recommends updating Zimbra with yum or apt to the latest release. Technical summary The quota flaw is an accounting weakness: an authenticated user can repeatedly share and unshare content to consume another user's mailbox quota. The advisory does not state a CVSS score, a fixed version for this specific CVE, a workaround, or detection guidance for it. The listed fixes span many classes, including stored and reflected XSS, LFI, SSRF, CSRF, XXE, authorization bypass, and command injection, with fix releases such as 10.1.21, 10.1.20, and 10.1.17, and most CVSS entries marked TBD. The advisory text is truncated, so the complete list and the fix release for CVE-2026-115786 cannot be confirmed from this text. Affected version ranges for the quota flaw, exploitation status, and vendor-published detection indicators are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Apache HTTP Server Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affects Apache PHP OpenSSL electron Zimbra OpenJDK ClamAV Nginx Rsync Spring Cyrus SASL Jetty TinyMCE PHP OpenSSL electron Zimbra Collaboration Suite Apache CXF Zimbra Desktop Zimbra Modern Zimbra Desktop OpenJDK ClamAV NGINX Rsync Apache HttpClient Spring Core Cyrus SASL Jetty TinyMCE Apache Log4j NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-115785	An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-115785An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options... Executive summary The advisory describes an SMTP command injection flaw in the data-source testing feature of Zimbra Collaboration Suite (ZCS). It says an ordinary authenticated user with account options can exploit it, but the text provided is truncated and does not give a severity rating or a fixed version for this specific CVE. The surrounding Zimbra security page lists many other fixes in recent releases, and the vendor's recommendation is to update Zimbra using yum or apt and to upgrade to the latest release. Technical summary The flaw is an SMTP command injection in the data-source testing functionality of Zimbra Collaboration Suite, reachable by an ordinary authenticated user who has account options (the text is cut off before the rest of the preconditions). The advisory excerpt does not state affected version ranges, a CVSS score for this CVE, a fixed version for this specific flaw, a workaround, or any exploitation status. The surrounding Zimbra table lists fixes in 10.1.21 and earlier releases, but it does not map this SMTP injection issue to a fix release. Detection guidance is not stated. Administrators should check Zimbra's security advisory page and the NVD entry for the complete affected version list before relying on any version information. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-10632	A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-10632A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages... Executive summary The advisory covers a Zimbra Collaboration Suite (ZCS) reflected cross-site scripting flaw in the Classic Web Client, tracked as CVE-2026-10632, which lets an attacker inject JavaScript through the packages parameter. The text presents the flaw as a reflected XSS issue but does not state a severity rating for it. The advisory does not state a specific vendor recommendation for CVE-2026-10632, though the surrounding Zimbra page recommends updating to the latest release. Technical summary The flaw is a reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite, triggered through the packages parameter. The advisory does not state the attack vector details, user interaction requirements, or whether authentication is needed. Affected versions are not stated for CVE-2026-10632, and no fixed version is listed for it in the text provided. No CVSS score, workaround, exploitation status, or detection guidance is stated for this CVE. The text is a truncated NVD summary, and the surrounding Zimbra advisory table lists many other fixes with fix releases such as 10.1.21, but these are not explicitly tied to CVE-2026-10632. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Low	3.7	CVE-2026-93637	An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL... ZimbraZimbra Collaboration Suite	NVD	Oct 14 17:20 UTC
CVE-2026-93637An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL... From the advisory An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 14, 2026 17:20 UTC Read the advisory
	Medium	5.3	CVE-2026-93635	LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters ZimbraZimbra Collaboration Suite	NVD	Oct 14 17:20 UTC
CVE-2026-93635LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters From the advisory LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 14, 2026 17:20 UTC Read the advisory
	Medium	6.5	CVE-2026-50055	A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email... ZimbraZimbra Collaboration Suite	NVD	Oct 8 17:17 UTC
CVE-2026-50055A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email... From the advisory A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 8, 2026 17:17 UTC Read the advisory
	High	7.1	CVE-2026-50054	An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs... ZimbraZimbra Collaboration Suite	NVD	Oct 8 17:17 UTC
CVE-2026-50054An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs... From the advisory An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry. Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 8, 2026 17:17 UTC Read the advisory
	Medium	6.5	CVE-2026-10631	An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox... ZimbraZimbra Collaboration Suite	NVD	Oct 8 17:17 UTC
CVE-2026-10631An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox... From the advisory An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 8, 2026 17:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited