Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
658 results · page 4 of 14
Oct 15, 2025A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attackCVE-2025-20329 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials to which they may not normally have access. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII). Note: To access the logs that are stored in the Webex Cloud or stored on the device itself, an attacker must have valid administrative credentials.
- Product
- Cisco RoomOS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2025Stalwart is a mail and collaboration server.CVE-2025-61600 · Other software · stalwartlabs · reported by GitHubHigh 7.5
Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.
- Product
- stalwart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-59040 · Other software · Enalean · reported by GitHubMedium 4.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordCVE-2025-54390 · Other software · reported by MITREMedium 6.3
A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the user's password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the user's consent.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Sep 16, 2025A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-FactoCVE-2025-54391 · Other software · reported by MITRECritical 9.1
A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Factor Authentication (2FA) protection. The attacker can configure an additional 2FA method (either a third-party authenticator app or email-based 2FA) without presenting a valid authentication token or proving access to an already configured 2FA method. This bypasses 2FA and results in unauthorized access to accounts that are otherwise protected by 2FA.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Sep 10, 2025Stalwart is a mail and collaboration server.CVE-2025-59045 · Other software · stalwartlabs · reported by GitHubHigh 7.1
Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through recurring event expansion. An authenticated attacker can crash the Stalwart server by creating recurring events with large payloads and triggering their expansion through CalDAV REPORT requests. A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability exists in the `ArchivedCalendarEventData.expand` function, which processes CalDAV `REPORT` requests with event expansion. When a client requests recurring events in their expanded form using the `<C:expand>` element, the server stores all expanded event instances in memory without enforcing size limits. Users should upgrade to Stalwart version 0.13.3 or later to receive a fix. If immediate upgrading is not possible, implement memory limits at the container/system level; monitor server memory usage for unusual spikes; consider rate limiting CalDAV REPORT requests; and restri
- Product
- stalwart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.CVE-2025-54877 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99.1754050155 and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special and always there fields of accessible artifacts even if the permissions associated with the underlying fields do not allow it. This issue has been fixed in Tuleap Community Edition version 16.10.99.1754050155 and Tuleap Enterprise Edition versions 16.9-8 and 16.10-5.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.CVE-2024-45515 · Email & office · Zimbra · reported by MITREMedium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript within the victim's session.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Jul 29, 2025Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.CVE-2025-53902 · Other software · Enalean · reported by GitHubMedium 4.3
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.CVE-2025-53541 · Other software · Enalean · reported by GitHubMedium 5.4
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3, malicious users with some control over certain artifacts could insert malicious code when displaying the children of a parent artifact to force victims to execute the uncontrolled code. This is fixed in version Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.CVE-2025-52899 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improperCVE-2025-53645 · Other software · reported by MITREHigh 7.5
Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can send specially crafted GET requests that trigger redundant processing and inflated responses. This leads to uncontrolled resource consumption, resulting in denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Jul 6, 2025Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidenCVE-2025-53167 · Other software · Huawei · reported by psirt@huawei.comMedium 6.9
Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-50179 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-48991 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCVE-2025-48700 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.
- Product
- Zimbra Collaboration Suite (ZCS)
- On CISA’s list since
- Apr 20, 2026 (federal fix deadline Apr 23, 2026)
- What to do
- Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogwiki.zimbra.comwiki.zimbra.com
Jun 18, 2025CryptPad is a collaboration suite.CVE-2025-49591 · Other software · cryptpad · reported by GitHubHigh 7.4
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.
- Product
- cryptpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025CryptPad is a collaboration suite.CVE-2025-49590 · Other software · cryptpad · reported by GitHubLow 2.9
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
- Product
- cryptpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, remoCVE-2025-20129 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data. This vulnerability is due to improper sanitization of HTTP requests that are sent to the web-based chat interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the chat interface of a targeted user on a vulnerable server. A successful exploit could allow the attacker to redirect chat traffic to a server that is under their control, resulting in sensitive information being redirected to the attacker.
- Product
- Cisco SocialMiner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 2, 2025Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensCVE-2025-27955 · Other software · Philips · reported by MITREMedium 6.5
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
- Product
- Clinical Collaboration Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken functCVE-2025-27954 · Other software · Philips · reported by MITREMedium 6.5
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.
- Product
- Clinical Collaboration Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comportswigger.net
Jun 2, 2025An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session managemCVE-2025-27953 · Other software · Philips · reported by MITREMedium 6.5
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component.
- Product
- Clinical Collaboration Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47.CVE-2024-45516 · Email & office · Synacor · reported by MITREMedium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
May 14, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-47781 · Other software · lukevella · reported by GitHubCritical 9.8
Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authentication. A token that consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes it possible for an unauthenticated attacker with knowledge of a valid email address to successfully brute force the token within 15 minutes (token expiration time) and take over the account associated with the targeted email address. All users on the Rallly applications are impacted. As long as an attacker knows the user's email address they used to register on the app, they can systematically take over any user account. For the authentication mechanism to be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable time, and ideally rate limiting the /api/auth/callback/email endpoint to further make brute force attempts unreasonable within the 15 minutes time. As of time of publication, no patc
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) ofCVE-2025-32354 · Email & office · Synacor · reported by MITREHigh 8.8
In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user visits a malicious website.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Apr 16, 2025Zulip is an open-source team collaboration tool.CVE-2025-31478 · Other software · zulip · reported by GitHubHigh 8.2
Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible to create an account in such organizations, without having an account with the configured SSO authentication backend. This issue is patched in version 10.2. A workaround includes requiring invitations to join the organization prevents the vulnerability from being accessed.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Zulip is an open-source team collaboration tool.CVE-2025-30369 · Other software · zulip · reported by GitHubLow 2.7
Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organization. This is fixed in Zulip Server 10.1.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Zulip is an open-source team collaboration tool.CVE-2025-30368 · Other software · zulip · reported by GitHubLow 2.7
Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10.1.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-30209 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-30203 · Other software · Enalean · reported by GitHubMedium 4.8
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-30155 · Other software · Enalean · reported by GitHubMedium 4.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-29929 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-29766 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCVE-2025-27915 · Email & office · Synacor · reported by MITREExploitedMedium 5.4
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
- Product
- Zimbra Collaboration Suite (ZCS)
- On CISA’s list since
- Oct 7, 2025 (federal fix deadline Oct 28, 2025)
- What to do
- Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogwiki.zimbra.comwiki.zimbra.com
Mar 12, 2025An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.CVE-2025-27914 · Email & office · Zimbra · reported by MITREMedium 5.4
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27402 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27401 · Other software · Enalean · reported by GitHubMedium 4.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27156 · Other software · Enalean · reported by GitHubMedium 4.1
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27150 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025FACTION is a PenTesting Report Generation and Collaboration Framework.CVE-2025-27422 · Other software · factionsecurity · reported by GitHubHigh 7.5
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
- Product
- faction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-27099 · Other software · Enalean · reported by GitHubMedium 4.8
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740067916 and Tuleap Enterprise Edition 16.4-5 and 16.3-10.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Tuleap is an open-source suite designed to improve software development management and collaboration.CVE-2025-27094 · Other software · Enalean · reported by GitHubMedium 5.4
Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute for the multiselectbox field, the default value, number of rows, and columns attributes for the text field, and the default value, size, and max characters attributes for the string field configurations are lost when added as criteria in a saved report. Additionally, in Tuleap Community Edition versions 16.4.99.1739806825 to 16.4.99.1739877910, this issue could be exploited to prevent access to tracker data by triggering a crash. This vulnerability has been fixed in Tuleap Community Edition 16.4.99.1739877910 and Tuleap Enterprise Edition 16.3-9 and 16.4-4.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-24029 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2025-22129 · Other software · Enalean · reported by GitHubMedium 4.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redCVE-2025-25065 · Email & office · Synacor · reported by MITREMedium 5.3
SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Feb 3, 2025SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sCVE-2025-25064 · Email & office · Synacor · reported by MITREHigh 8.8
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Jan 21, 2025Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized loss of dataCVE-2024-12104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
- Product
- Visual Website Collaboration, Feedback & Project Management – Atarim
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 19, 2024An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.CVE-2024-54663 · Email & office · Synacor · reported by MITREHigh 7.5
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Dec 9, 2024Tuleap is an open source suite to improve management of software developments and collaboration.CVE-2024-52599 · Other software · Enalean · reported by GitHubMedium 5.4
Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.CVE-2024-45517 · Email & office · Synacor · reported by MITREMedium 5.4
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitization of user input, leading to potential compromise of sensitive information. Exploitation requires user interaction to access the malicious URL.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.