ZoneMinder has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 4. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-78 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Worst active — by depth score
CVE-2026-30971High· 8.8ZoneMinder is a free, open source closed-circuit television software application61CVE-2026-102607High· 8.8ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature60CVE-2026-102608Critical· 9.0ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)50CVE-2026-102296Medium· 6.5ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers.…48CVE-2026-54258Medium· 6.5ZoneMinder is a free, open source closed-circuit television software application48
ZoneMinder vulnerabilities
CVEs affecting ZoneMinder, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-30971High· 8.8PoCZoneMinder is a free, open source closed-circuit television software application
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an…
CVE-2026-102607High· 8.8PoCZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing sh…
CVE-2026-102608Critical· 9.0ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell command…
CVE-2026-104198Medium· 5.3PoCZoneMinder is a free, open source closed-circuit television software application
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a…
CVE-2026-102297Medium· 4.3PoCZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied a…
CVE-2026-102296Medium· 6.5PoCZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers.…
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers.…
CVE-2024-58386Medium· 6.5ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, e…
CVE-2026-54258Medium· 6.5PoCZoneMinder is a free, open source closed-circuit television software application
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to …