Medium
CVE-2025-49643
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending sp…
Medium
CVE-2025-27232
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver le…
Medium
CVE-2025-49641
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refre…
Medium
CVE-2025-27231
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host…
Low
CVE-2025-27236
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have…
High
CVE-2025-27240
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visibl…