CVE-2026-23919 Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

CVE-2026-23919

CVE-2026-23919 affects Zabbix Server/Proxy where JavaScript (Duktape) contexts are reused for performance, potentially causing confidentiality leakage by non-super administrators who can access hosts they shouldn’t. The issue stems from shared execution contexts used by script items, JavaScript r...

CVE-2009-4501

The zbxgetnextfield function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service crash via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword...

CVE-2009-4499

SQL injection vulnerability in the gethistorylastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the sendhistorylastid function in zabbixserver/trapper/nodehistory.c...

CVE-2009-4500

The processtrap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service crash via a crafted request with data that lacks an expected : colon separator, which triggers a NULL pointer dereference...

EUVD-2017-11966

Malware in sbrugna...

EUVD-2009-4465

Malware in sbrugna...

EUVD-2009-4467

Malware in sbrugna...

EUVD-2017-11967

Malware in sbrugna...

EUVD-2009-4466

Malware in sbrugna...

EUVD-2023-33019

Malicious code in bioql PyPI...

EUVD-2024-54345

Malicious code in bioql PyPI...

EUVD-2024-39879

Malicious code in bioql PyPI...

EUVD-2024-36349

Malicious code in bioql PyPI...

EUVD-2023-33020

Malicious code in bioql PyPI...

CVE-2025-27240 Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field...

CVE-2025-27240

CVE-2025-27240.doc: A Zabbix Server vulnerability lets an administrator inject arbitrary SQL during autoremove of hosts by inserting malicious SQL in the ‘Visible name’ field. Affected: Zabbix Server host autoremove logic; root cause is SQL injection in the Visible name field. Impact per CVSS: hi...

Linux Distros Unpatched Vulnerability : CVE-2024-36468

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The reported vulnerability is a stack buffer overflow in the zbxsnmpcachehandleengineid function within the Zabbix server/proxy code. This issue occurs when...

Linux Distros Unpatched Vulnerability : CVE-2017-2826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabb...

Gopherus

This tool is called Gopherus and it generates gopher links for exploiting Server-Side Request Forgery SSRF and gaining Remote Code Execution RCE in various servers. The tool can be used to exploit vulnerabilities in MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP servers. The tool...