Veille CVE

Mardi 29 septembre 2026

4 CVE

Critique 4 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Zimbra Collaboration Suite » ✕
  1. CVE-2026-93647 9.3 Critique

    Zimbra Collaboration Suite (ZCS)

    An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

  2. CVE-2026-93643 9.8 Critique

    Zimbra Collaboration Suite (ZCS)

    When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

  3. CVE-2026-93642 9.3 Critique

    Zimbra Collaboration Suite (ZCS)

    An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

  4. CVE-2026-93641 9.3 Critique

    Zimbra Collaboration Suite (ZCS)

    An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.