By year
13
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Synacor flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command InjectionExploited since Aug 21, 2026 · CVSS 8.9
- CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site ScriptingExploited since Apr 20, 2026 · CVSS 6.1
- CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site ScriptingExploited since Mar 18, 2026 · CVSS 7.2
- CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request ForgeryExploited since Feb 17, 2026 · CVSS 9.8
- CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File InclusionExploited since Jan 22, 2026 · CVSS 8.8
- CVE-2025-27915 Synacor Zimbra Collaboration Suite (ZCS) Cross-site ScriptingExploited since Oct 7, 2025 · CVSS 5.4
- CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)Exploited since Jul 7, 2025 · CVSS 7.5
- CVE-2024-27443 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited since May 19, 2025 · CVSS 6.1
- CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited since Feb 25, 2025 · CVSS 9
- CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) Command ExecutionExploited since Oct 3, 2024 · CVSS 10
- CVE-2023-37580 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited since Jul 27, 2023 · CVSS 6.1
- CVE-2022-27926 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited since Apr 3, 2023 · CVSS 6.1
- CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadExploited since Oct 20, 2022 · ransomware · CVSS 9.8
- CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadExploited since Aug 11, 2022 · ransomware · CVSS 7.2
- CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS) Authentication BypassExploited since Aug 11, 2022 · ransomware · CVSS 9.8
- CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS) Command InjectionExploited since Aug 4, 2022 · ransomware · CVSS 7.5
- CVE-2018-6882 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited since Apr 19, 2022 · ransomware · CVSS 6.1
- CVE-2022-24682 Synacor Zimbra Collaborate Suite (ZCS) Cross-Site ScriptingExploited since Feb 25, 2022 · ransomware · CVSS 6.1
- CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceExploited since Jan 10, 2022 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command InjectionExploited · High 8.9 · Aug 13, 2026
- CVE-2026-33373 An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.High 8.8 · Mar 30, 2026
- CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site ScriptingExploited · High 7.2 · Jan 5, 2026
- CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File InclusionExploited · High 8.8 · Dec 22, 2025
- CVE-2025-32354 In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) ofHigh 8.8 · Apr 29, 2025
- CVE-2025-25064 SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sHigh 8.8 · Feb 3, 2025
- CVE-2024-54663 An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.High 7.5 · Dec 19, 2024
- CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) Command ExecutionExploited · Critical 10 · Oct 2, 2024
- CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Exploited · Critical 9 · Jul 6, 2023
- CVE-2022-3569 Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, wHigh 7.8 · Oct 17, 2022
- CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadExploited · Critical 9.8 · Sep 25, 2022
- CVE-2022-37393 Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters.High 7.8 · Aug 16, 2022
- CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS) Authentication BypassExploited · Critical 9.8 · Aug 12, 2022
- CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadExploited · High 7.2 · Apr 20, 2022
- CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS) Command InjectionExploited · High 7.5 · Apr 20, 2022
- CVE-2020-12846 Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file.High 8 · Jun 3, 2020
- CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request ForgeryExploited · Critical 9.8 · Feb 18, 2020
- CVE-2014-8563 Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.Critical 9.8 · Jan 27, 2020
- CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceExploited · Critical 9.8 · May 29, 2019
- CVE-2019-6980 Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.Critical 9.8 · May 29, 2019
- CVE-2018-20160 ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, Critical 9.8 · May 29, 2019
- CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)Exploited · High 7.5 · Apr 30, 2019
- CVE-2015-7610 Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, anHigh 8.8 · May 30, 2018
- CVE-2017-6821 Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors.Critical 9.8 · May 23, 2017
- CVE-2017-6813 A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations.Critical 9.8 · May 23, 2017
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.