Veille CVE

Recherche « Zabbix Frontend »

7 CVE

Critique 1 Élevée 1 Moyenne 4 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Zabbix Frontend » ✕
  1. CVE-2026-59785 5.1 Moyenne

    Zabbix

    Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.

  2. CVE-2026-23934 6.5 Moyenne

    Zabbix · Zabbix zabbix

    An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.

  3. CVE-2026-23933 9.1 Critique

    Zabbix · Zabbix zabbix

    In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.

  4. CVE-2026-23931 4.3 Moyenne

    Zabbix · Zabbix zabbix

    The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.

  5. CVE-2026-23930 7.5 Élevée

    Zabbix · Zabbix zabbix

    An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.

  6. CVE-2026-1199 3.7 Faible

    Zabbix · Zabbix zabbix

    Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

  7. CVE-2022-23134 5.3 Moyenne Exploitée

    Zabbix Frontend · Zabbix zabbix · Fedoraproject fedora · Debian debian linux

    After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.