zulip has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.3 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-102893Critical· 9.1Zulip is an open-source team collaboration tool50CVE-2026-100404Medium· 6.5Zulip is an open-source team collaboration tool36CVE-2026-26058Medium· 6.1Zulip is an open-source team collaboration tool34CVE-2026-25742Medium· 5.3Zulip is an open-source team collaboration tool29
zulip vulnerabilities
CVEs affecting zulip, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-102893Critical· 9.1Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false ema…
CVE-2026-100404Medium· 6.5Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event que…
CVE-2026-26058Medium· 6.1Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes t…
CVE-2026-25742Medium· 5.3Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS…