CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 6:40 AM ET)

What this means for you

This week: 3,335 CVEs published, 226 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,335; Show in the list
Critical, last 7 days: 226; Show in the list
Healthcare-tagged, last 7 days: 3; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product synacor:zimbra_collaboration_suite. Show all products

35 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2018-6882 Known exploited	Medium 6.1	Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers… Assigned by mitre	Mar 27, 2018
CVE-2019-9621 Known exploited	High 7.5	Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Assigned by mitre	Apr 30, 2019
CVE-2019-9670 Known exploited	Critical 9.8	mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. Assigned by mitre	May 29, 2019
CVE-2020-7796 Known exploited	Critical 9.8	Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. Assigned by mitre	Feb 18, 2020
CVE-2022-24682 Known exploited	Medium 6.1	An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. Assigned by mitre	Feb 8, 2022
CVE-2022-27924 Known exploited	Critical 9.8	Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. Assigned by mitre	Apr 20, 2022
CVE-2022-27925 Known exploited	High 7.2	Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. Assigned by mitre	Apr 20, 2022
CVE-2022-27926 Known exploited	Medium 6.1	A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web scrip… Assigned by mitre	Apr 20, 2022
CVE-2022-37042 Known exploited	Critical 9.8	Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. Assigned by mitre	Aug 11, 2022
CVE-2022-41352 Known exploited	Critical 9.8	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Assigned by mitre	Sep 25, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.