Medium
CVE-2025-49643
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending sp…
Medium
CVE-2025-27232
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver le…
Medium
CVE-2025-49641
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refre…
Medium
CVE-2025-27231
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host…
Low
CVE-2025-27236
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have…
Low
CVE-2025-27238
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user gr…