2123 matches found
CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a race condition: simultaneous failed login requests are not properly counted toward the block counter, allowing more password guesses than intended. CVSS 4.0 base score 6.9 (MEDIUM), network-accessible, no privileges required. Nessus flags it a...
GO-2025-4173 vulnerabilities
Vulnerabilities for packages: zabbix-agent2, falcosidekick, dapr, minio, dapr-fips, agentbeat, beats-fips, elastic-agent, elastic-agent-fips, beats, bento, telegraf, influxd, zabbix-agent2-fips, minio-fips, agentbeat-fips, falcosidekick-fips...
Zabbix - SAML SSO Authentication Bypass
When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...
The vulnerability of the Zabbix Agent 2 component of the Zabbix IT-infrastructure monitoring system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
system-user-zabbix-7.0.28-1.1 on GA media (moderate)
system-user-zabbix-7.0.28-1.1 on GA media Announcement ID: openSUSE-SU-2026:11304-1 Rating: moderate Cross-References: CVE-2026-25680 CVE-2026-42502 CVSS scores: CVE-2026-25680 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25680 SUSE : 8.7...
OPENSUSE-SU-2026:11304-1 system-user-zabbix-7.0.28-1.1 on GA media
These are all security issues fixed in the system-user-zabbix-7.0.28-1.1 package on the GA media of openSUSE Tumbleweed...
Exploit for Authentication Bypass by Spoofing in Zabbix
CVE-2022-23131 - Zabbix SAML SSO Authentication Bypass + RCE...
CVE-2026-45304 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
CVE-2026-45305 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
CVE-2026-45133 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-9FRC-8383-795M vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-4QPC-3HR4-R2P4 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-C2P3-7M5P-CV8X vulnerabilities
Vulnerabilities for packages: zabbix-fips...
Vuln2Action-Demo
Vuln2Action-Demo This repository contains the demo video for t...
bug-bounty-hunts
Bug Bounty Hunts Curated writeups and proof-of-concept materi...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code for the graphs page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...
Astra Linux – Vulnerability in Zabbix
JavaScript preprocessing can be exploited by attackers to gain access to the file system read-only access on behalf of the user “zabbix” on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing XSS payloads for action pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page, and can make arbitrary modifications to the contents of the page displayed to the victim. This attack can be...
Astra Linux – Vulnerability in Zabbix
Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...