Zabbix 7.0.0 → 7.0.30
30 releases · 0 breaking changes · 36 security fixes · 50 advisories fixed
36security0breaking0deprecated42feature234fix
Vulnerabilities fixed by this upgrade
- 7.8 CVE-2026-59781 When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…
- 4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- 5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
- 7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
- 4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
- 6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
- 3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
- 6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
- 6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
- 6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
- 6.0 CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 3.5 CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
- 7.2 CVE-2025-27240 A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
- 3.5 CVE-2024-42325 Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
- 5.4 CVE-2024-45699 The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
- 6.5 CVE-2024-45700 Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
- 3.1 CVE-2024-36469 Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
- 8.8 CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
- 8.8 CVE-2024-36466 A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.
- 9.1 CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t…
- 3.3 CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error…
- 3.7 CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a…
- 2.7 CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c
- 3.0 CVE-2024-36468 The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE…
- 4.4 CVE-2024-42326 There was discovered a use after free bug in browser.c in the es_browser_get_variant function
- 9.9 CVE-2024-42327 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the add…
- 3.3 CVE-2024-42328 When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is…
- 3.3 CVE-2024-42329 The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr…
- 7.5 CVE-2024-36467 An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (…
- 2.2 CVE-2024-22117 When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H…
- 6.5 CVE-2024-36463 The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
- 9.1 CVE-2024-36461 Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.
- 7.5 CVE-2024-36462 Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or co…
- 8.1 CVE-2024-36460 The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
- 6.1 CVE-2024-22121 A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
- 3.0 CVE-2024-22122 Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test…
- 2.7 CVE-2024-22123 Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server…
- 4.3 CVE-2024-22114 User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
- 9.9 CVE-2024-22116 An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user…
- 9.1 CVE-2024-22120 Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injec…
- 5.5 CVE-2024-22119 The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
- 9.6 CVE-2023-32722 The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.
- 9.1 CVE-2023-32724 Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
- 7.6 CVE-2023-32721 A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a… in 7.0.29
- security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
- security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
- security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28
- security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
- security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27
- security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
- security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
- security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
- security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
- security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.0.19
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
- security Fixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. in 7.0.14
- security Fixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an… in 7.0.10
- security Fixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. in 7.0.9
- security Fixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. in 7.0.9
- security Fixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri… in 7.0.7
- security Fixes CVE-2024-42330: The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t… in 7.0.4
- security Fixes CVE-2025-27240: A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. in 7.0.4
- security Fixes CVE-2024-42331: In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error… in 7.0.4
- security Fixes CVE-2024-42328: When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is… in 7.0.4
- security Fixes CVE-2024-42329: The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr… in 7.0.4
- security Fixes CVE-2024-42333: The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c in 7.0.4
- security Fixes CVE-2024-22117: When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H… in 7.0.4
- security Fixes CVE-2024-36463: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. in 7.0.3
- security Fixes CVE-2024-42326: There was discovered a use after free bug in browser.c in the es_browser_get_variant function in 7.0.3
- security Fixes CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a… in 7.0.3
- security Fixes CVE-2024-36468: The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE… in 7.0.3
- security Fixes CVE-2024-36467: An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (… in 7.0.2
- security Fixes CVE-2024-42327: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the add… in 7.0.1
Every release in between
feature[ZBXNEXT-10720] updated maximum supported TimescaleDB version to 2.29 (mprihodko)
feature[ZBXNEXT-10732] updated help URL from the frontend to documentation (scernisenko)
fix[ZBX-27836] fixed PHP runtime errors in user role edit form (Ivo)
fix[ZBX-28045] fixed active checks in case of failed response on Zabbix agent 2 (aetatsu)
fix[ZBX-23057] fixed memory fragmentation trigger and added RSS overhead triggers in Redis by Zabbix agent 2 template (mruszczyk)
fix[ZBX-27746] removed unsupported discovery worker targets and preprocessing worker profiling targets from Zabbix server and proxy help messages and man pages (rtrizna)
fix[ZBX-27791] added multiplier to percent_used metric in Ceph by Zabbix agent 2 template (mruszczyk)
fix[ZBX-27646] removed MS Teams webhook in default data (egordymov)
fix[ZBX-25042] removed discard option for SNMP status items (kflorowski)
fix[ZBX-25663] added node name macro to RabbitMQ node templates (abrosimovs)
fix[ZBX-26229] fixed CPU user and idle time OIDs in Check Point NGFW SNMP template (mruszczyk)
fix[ZBX-27861] fixed correct shape form layout corruption in Safari on reopen (msnihach)
fix[ZBX-25608] fixed missing precision for temperature sensors for Cisco template (kflorowski)
fix[ZBX-22458] fixed cache hit ratio base typo in MSSQL by ODBC template (mruszczyk)
fix[ZBX-25484] fixed incorrect item configuration in default data (egordymov)
fix[ZBX-21236] improved metrics filtering in API response for the Elasticsearch Cluster by HTTP template (smansurovs)
fix[ZBX-24512] fixed memory items in Cisco Nexus 9000 Series by SNMP template (kflorowski)
fix[ZBX-24343] fixed temperature threshold trigger duplication for Cisco IOS by SNMP (kflorowski)
fix[ZBX-27893] fixed infinite loop for graphs in hosts monitoring when working time period in GUI is 00:00-24:00 (scernisenko)
fix[ZBX-27646] removed MS Teams webhook based on retired Office 365 Connector (mruszczyk)
fix[ZBX-27908] fixed icon mapping order for individual list item (scernisenko)
fix[ZBX-27920] fixed event menu entry parameters being marked as required when they are disabled (scernisenko)
fix[ZBX-25485] fixed language change to work for different environments (gberzina)
fix[ZBX-25815] removed mention of discovery from SNMP max_repetition help note (vskalbins)
fix[ZBX-27140] fixed overall hintbox positioning (dfofanovs)
securityFixes CVE-2026-59781: When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory a…
feature[ZBXNEXT-10669] updated maximum supported TimescaleDB version to 2.28 (mprihodko)
fix[ZBX-28197] improved validation of SNMP trap payload in zabbix_trap_receiver.pl (MVekslers)
fix[ZBX-28196] added heartbeat connection type and frequency validation (sboidenko)
fix[ZBX-28195] implemented validation of parameters for jsrpc.php (Ivo)
fix[ZBX-28194] fixed memory allocation size for binary items on MySQL/MariaDB (sboidenko)
fix[ZBX-28193] fixed JavaScript preprocessing memory initialization (MVekslers)
fix[ZBX-27975] fixed potential VMware collector crash caused by network connectivity issues to vCenter (MVekslers)
fix[ZBX-21745] fixed duplicate discovery key and JavaScript preprocessing in RabbitMQ templates (abrosimovs)
fix[ZBX-26953] fixed redirect functionality for discovery rules, host prototypes, graphs, graph prototypes, web scenarios, and maps (msnihach)
fix[ZBX-27453] fixed average trend calculation to avoid producing inf values when dealing with DBL_MAX input; updated timeleft() function to return DBL_MAX when threshold cannot be reached and history approaches DBL_MAX (arimdjonoks)
fix[ZBX-27665] fixed remote command execution failing for trigger action operations when target host is monitored by proxy group (vsmelovs)
fix[ZBX-27689] fixed permission check for bulk actions in hosts web monitoring list (scernisenko)
fix[ZBX-27922] added retry to persistent buffer writes (esneiders)
fix[ZBX-26916] fixed some websites not having their certificates accessed (dbriedis)
fix[ZBX-27724] fixed build script for Zabbix web service (opucka)
fix[ZBX-18840] fixed misleading comments in Zabbix agent 2 (dbriedis)
fix[ZBX-25578] fixed GCP get db instances script (kflorowski)
fix[ZBX-27024] resolved system.run failing and race conditions (opucka)
fix[ZBX-27139] fixed naming and description of PLE trigger in MSSQL by Zabbix agent 2 template (smansurovs)
fix[ZBX-26704] fixed redundant preprocessing before discarding values (kflorowski)
fix[ZBX-26465] improved aria-label text for all functional buttons and icons and aria-expanding of side menu elements for screen reader users (aluchko)
securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)
feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)
feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)
feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)
feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)
fix[ZBX-28076] improved login handling (vbodrihins)
fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)
fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)
fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)
fix[ZBX-27883] fixed inability to copy trigger prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)
fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)
fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)
fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)
fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)
fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)
fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)
fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)
fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)
fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)
fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)
fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)
fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)
fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)
fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)
fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)
fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)
fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)
securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)
fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)
fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)
fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)
fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)
fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)
fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)
fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)
fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)
fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)
fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)
fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)
fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)
fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)
fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)
fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)
fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)
fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)
fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)
feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)
feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)
feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)
fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)
fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)
fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)
fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)
fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)
fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)
fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)
fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)
fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)
fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)
fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)
fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)
fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)
securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)
feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)
feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)
feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)
feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)
feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)
fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)
fix[ZBX-27662] renamed GLPI media type (mruszczyk)
fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)
fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)
fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)
fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)
fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)
fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)
fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)
fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)
fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)
fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)
fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)
fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)
fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)
fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)
fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)
fix[ZBX-26899] fixed yaml markings for import compare (gberzina)
fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)
fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)
fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)
securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)
fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)
feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)
feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)
feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)
feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)
fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)
fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)
fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)
fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)
fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)
fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)
fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)
fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)
fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)
fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)
fix[ZBX-26910] fixed Zabbix server and Zabbix proxy compilation on macOS or with custom library paths (vso)
fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)
fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)
fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)
fix[ZBX-26459] fixed Host macros view to avoid displaying both macro types when switching quickly (gberzina)
fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)
fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)
fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)
fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)
fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)
fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)
fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)
fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)
fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)
securityFixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
feature[ZBXNEXT-10143] added "Highlight whole row" feature in non-compact mode in Problems (ashubin)
feature[ZBXNEXT-10106] extended preprocessor throughput monitoring in Zabbix server/proxy health templates (aiantsen)
feature[ZBXNEXT-9819] added new template Vyatta Virtual Router by SNMP (knaglis)
feature[ZBXNEXT-9933] added TNS name support for Zabbix agent 2 Oracle plugin (lsurvilo)
feature[ZBXNEXT-10107] improved device coverage in Huawei OceanStor Dorado by SNMP template (abrosimovs)
feature[ZBXNEXT-10123] added Aruba CX 8300s by SNMP template (akotsegubov)
feature[ZBXNEXT-10152] added new macro for disk discovery type selection in both SMART by Zabbix agent 2 templates (knaglis)
feature[ZBXNEXT-10027] prepared for removal of TimescaleDB API call deprecated since TimescaleDB 2.18.0 (jfreibergs)
feature[ZBXNEXT-10017] added Ciena 3906 by SNMP template (akotsegubov)
feature[ZBXNEXT-9255] updated Meraki templates to handle rate limit on API requests (aiantsen)
feature[ZBXNEXT-9902] changed timeout range for Zabbix JS and Zabbix get utilities (askolmeisters)
feature[ZBXNEXT-10077] updated maximum supported MariaDB version to 12.0 (mprihodko)
fix[ZBX-26419] improved performance of problem and event views by optimizing SQL queries to join only necessary triggers, eliminating redundant post-join filtering (vso)
fix[ZBX-25796] fixed confusing error message on item test timeout (isharha)
fix[ZBX-26337] removed unnecessary div elements for entries without problems in Item and Host navigator widgets (msnihach)
fix[ZBX-26873] fixed support for SSH item proxy through configurations in SSH configuration file (aetatsu)
fix[ZBX-19267] fixed wmi.get items sometimes incorrectly returning "Empty WMI search result" with Zabbix agent 2 (aetatsu)
fix[ZBX-20207] fixed unexpected interface connection mode change during autoregistration (vso)
fix[ZBX-25448] fixed token-based authentication method in FortiGate by HTTP template (egordymov)
fix[ZBX-26847] explicitly defined Oracle connection timezone in Zabbix agent 2 (opucka)
fix[ZBX-26472] fixed clearing of elements when imported file contains no background image or icon map (rgontarski)
fix[ZBX-26694] fixed media type test parameter maxlength (gberzina)
fix[ZBX-26416] fixed SNMP trap item processing issue after monitored host changes (sboidenko)
fix[ZBX-26801] fixed ability to select discovered items when editing graph items (gberzina)
fix[ZBX-20964] removed Problems link in Monitoring hosts page for user who does not have access (msnihach)
fix[ZBX-26621] added TLS host parameter update in autoregistration mode (vsmelovs)
fix[ZBX-26440] fixed inability to update JMX endpoint field in item, item prototype, and LLD forms (kkuzmina)
fix[ZBX-25041] improved configuration form validation in Graph and Pie chart widgets when referenced item widget is unavailable (isharha)
fix[ZBX-24720] fixed LDAP media type mapping "When active" field trimming (dpankins)
fix[ZBX-26892] fixed VMware Event Collector hangs in case of network errors (MVekslers)
fix[ZBX-26920] fixed wrong time in Zabbix agent for Windows (sboidenko)
fix[ZBX-25669] added trigger version check after upgrading to newer version (aluchko)
fix[ZBX-22786] fixed trends graph line color issue with PHP 8.1 (isharha)
fix[ZBX-26044] fixed Honeycomb widget not to display disabled items (rgontarski)
fix[ZBX-25540] fixed inconsistent link styling for dependent trigger prototypes (rgontarski)
fix[ZBX-26482] fixed TypeError after deleting datasets in Graph and Pie chart widgets (isharha)
fix[ZBX-26202] fixed inability to create "Execute now" tasks for users of Admin user type (jfreibergs)
fix[ZBX-24603] fixed MFA TOTP secrets not being deleted when deleting users from MFA-enabled user groups (agriscenko, jfreibergs)
fix[ZBX-25739] fixed timeleft() function to return 1.7976931348623157E+308 instead of making item unsupported in case of infinite time (arimdjonoks, averza)
+11 more items in the release notessecurityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)
fix[ZBX-26589] fixed DNS queries being performed for IP addresses when using older c-ares library (vso)
fix[ZBX-26610] fixed some tasks being stuck in preprocessing queue (wiper)
fix[ZBX-26588] fixed finished tasks queue size tracking which caused high cpu utilization by preprocessing manager (wiper)
securityFixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)
feature[ZBXNEXT-9942] added preprocessor throughput to Zabbix server health templates (aiantsen)
feature[ZBXNEXT-9989] added supergroup topics support to Telegram media type, updated documentation (drasikhov)
fix[ZBX-26988] fixed non-super admin user restriction working incorrectly for hostprototype.get api method (aluchko)
fix[ZBX-26537] fixed memory over-allocation in preprocessing manager (vso)
fix[ZBX-26422] added missing translation string for "Tags" label in "Tags" tab in configuration forms (solonkins)
fix[ZBX-26294] improved logic of SNMP cache cleanup (dgoloscapov)
fix[ZBX-25929] improved digital clock widget element sizing (apoga)
fix[ZBX-21087] fixed not all aggregation functions working with foreach functions (aluchko)
fix[ZBX-26191] fixed inconsistent API and frontend validation for maintenance period 'every' and 'period' fields (aluchko)
fix[ZBX-23167] fixed issues with Host dashboards not displaying widgets from inaccessible templates; added hostdashboard object API (jfreibergs, vmaksimovs)
fix[ZBX-26123] added hostid parameter validation in web scenario configuration form (msnihach)
fix[ZBX-25420] fixed regsub/iregsub returning output if there is no match (talbergs)
fix[ZBX-26446] fixed Zabbix agent 2 S.M.A.R.T plugin failing on non-fatal exit status codes (esneiders)
fix[ZBX-26426] fixed preprocessing to flush values for an item in the same order they were sent to preprocessing (wiper)
fix[ZBX-26529] fixed memory leak when global variables are used in JavaScript preprocessing (vso)
fix[ZBX-26469] fixed Zabbix proxy crash in discovery manager process (Andris, MVekslers)
fix[ZBX-26187] fixed response to wmi.getall from Zabbix agent 2 not returning array-type values (mprihodko)
fix[ZBX-25944] replaced container name with container ID where used in queries and items for both Oracle templates and Oracle Zabbix agent 2 plugin (knaglis)
fix[ZBX-26131] disabled the menu item "Create trigger prototype" for item prototypes with binary data type (msnihach)
fix[ZBX-26478] fixed Zabbix server crash when shutting down DB and sending alert using script media type with no parameters (askolmeisters)
fix[ZBX-26116] fixed overload in history cache by vmware.eventlog item (MVekslers)
fix[ZBX-25968] added configuration validation of DBPort and DBSocket (rtrizna)
fix[ZBX-26344] refactored zbxcmd execute to avoid windows syscalls in Zabbix agent 2 (esneiders)
fix[ZBX-26433] fixed values outside of history storage period causing trigger to cache all values in storage period (vso)
fix[ZBX-25175] increased retry to 5 for asynchronous SNMP pollers to avoid failure if one of packets is lost (vso)
fix[ZBX-26092] fixed Office 365 relay media type domain formatting to replace all dash symbols with dot (msnihach)
fix[ZBX-26313] fixed SNMP preprocessing causing item to be unsupported when encountering wrong type (dgoloscapov)
fix[ZBX-26387] fixed newline being truncated in SNMP "get[" check (dgoloscapov)
fix[ZBX-26372] fixed long-running TimescaleDB queries when requesting historical data (gcalenko, Sasha)
fix[ZBX-26339] fixed user macro resolving order in templates so that in case of conflict import order of templates takes precedence over the linking order (askolmeisters)
fix[ZBX-18703] removed preprocessing step for mounted fs discovery in VMware Guest template (akotsegubov)
fix[ZBX-25713] fixed the map navigation tree widget selection issue (wczerneha)
fix[ZBX-26466] added ability for generic users to open the templates popup (Sasha)
fix[ZBX-26244] fixed Zabbix agent 2 memory leak related to traffic compression (MVekslers)
fix[ZBX-26114] improved Zabbix agent 2 accept rate on high RTT (sjurgensons)
fix[ZBX-25526] made Zabbix agent 2 proc.num, proc.cpu.util, proc.get and proc.mem items behave consistently with Zabbix agent when non-existing user is specified (arimdjonoks)
fix[ZBX-26369] added ticket type parameter to OTRS CE media type, updated documentation, added missing web service file (drasikhov)
fix[ZBX-26297] improved server warning log message for out of order value identifier detection between Zabbix server and Zabbix proxy (rtrizna)
+6 more items in the release notesfeature[ZBXNEXT-9909] added Azure Backup Jobs by HTTP template (abrosimovs)
feature[ZBXNEXT-9905] updated max supported TimescaleDB version to 2.19 (mprihodko)
feature[ZBXNEXT-9813] added vm/hv UUID filter for vmware.datastore.discovery item (MVekslers)
feature[ZBXNEXT-9927] implemented masking of secret user macros that are explicitly used (mprihodko)
feature[ZBXNEXT-9937] updated PostgreSQL templates to support versions 17 and above (drasikhov)
fix[ZBX-26259] fixed issue of event created from trigger prototypes missing tags inherited from templates (arimdjonoks)
fix[ZBX-26270] fixed database sync error after removing interface used by item (sboidenko)
fix[ZBX-26319] fixed timeout in remote script execution to use TrapperTimeout instead of 60 s (askolmeisters)
fix[ZBX-25402] fixed numbered user macro parsing in macro function (askolmeisters)
fix[ZBX-26050] updated dashboards in Zabbix server/proxy health templates (aiantsen)
fix[ZBX-26390] updated templated dashboard help icon link (Sasha)
fix[ZBX-25691] fixed the Problems by severity widget to display all existing problems (wczerneha)
fix[ZBX-25931] updated LLD filters in Systemd by Zabbix agent 2 template (drasikhov)
fix[ZBX-26292] fixed typo in script items for family of Nutanix templates (akotsegubov)
fix[ZBX-24341] fixed {HOST.CONN}, {HOST.DNS}, {HOST.IP}, and {HOST.PORT} macros to be properly resolved in HTTP agent item fields (asestakovs)
fix[ZBX-23996] fixed errors in Item value widget when change indicator was displayed without value (dfofanovs)
fix[ZBX-26198] filtered out items that do not affect interface availability status (dfofanovs)
fix[ZBX-26298] fixed expansions of all further user macros after undefined user macro (sboidenko)
fix[ZBX-26335] fixed trigger expression in Azure SQL Managed Instance by HTTP template (abrosimovs)
fix[ZBX-26235] fixed Zabbix server crash caused by audit when autoregistration deletes host tags (arimdjonoks)
otherZABBIX 7.0.12
otherZABBIX 7.0.11rc2
securityFixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
otherZABBIX 7.0.10
securityFixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
securityFixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
otherZABBIX 7.0.9
otherZABBIX 7.0.8rc2
securityFixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
otherZABBIX 7.0.7rc1
otherZABBIX 7.0.6rc1
otherZABBIX 7.0.5
securityFixes CVE-2024-42330: The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t…
securityFixes CVE-2025-27240: A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
securityFixes CVE-2024-42331: In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error…
securityFixes CVE-2024-42328: When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is…
securityFixes CVE-2024-42329: The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr…
securityFixes CVE-2024-42333: The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c
securityFixes CVE-2024-22117: When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H…
otherZABBIX 7.0.4
securityFixes CVE-2024-36463: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
securityFixes CVE-2024-42326: There was discovered a use after free bug in browser.c in the es_browser_get_variant function
securityFixes CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a…
securityFixes CVE-2024-36468: The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE…
otherZABBIX 7.0.3
securityFixes CVE-2024-36467: An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (…
otherZABBIX 7.0.2
securityFixes CVE-2024-42327: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the add…
otherZABBIX 7.0.1