zimbra_collaboration vulnerabilities
CVEs whose affected-version data names the zimbra_collaboration package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-66912Medium· 5.3Stored Cross-Site Scripting in Zimbra
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email contai…
▾ SunlitSynacor · Zimbra CollaborationEPSS 0.47%via CVEORG
CVE-2026-66911Medium· 5.3Stored Cross-Site Scripting in Zimbra
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthentica…
▾ SunlitSynacor · Zimbra CollaborationEPSS 0.54%via CVEORG