Zimaspace

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Zimaspace records in CISA KEV

No Zimaspace vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Zimaos 12 records HIGH

Records

12 records

TI-2026-17591 CVE-2026-21891

ZimaOS has Authentication Bypass via System-Level Username

HIGH 82

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02316 Published 2026-01-08 No fix listed CWE-287

TI-2024-32947 CVE-2024-49359

ZimaOS vulnerable to Directory Listing via Parameter Manipulation

HIGH 74

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00967 Published 2024-10-24 No fix listed CWE-552

TI-2024-32626 CVE-2024-48931

ZimaOS Arbitrary File Read via Parameter Manipulation

HIGH 74

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00712 Published 2024-10-24 No fix listed CWE-22

TI-2026-22712 CVE-2026-28442

ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation

HIGH 72

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1HIGH 8.6 Network Low privileges No interaction EPSS 0.00346 Published 2026-03-05 No fix listed CWE-73

TI-2024-32945 CVE-2024-49357

ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

HIGH 72

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.23655 Published 2024-10-24 No fix listed CWE-200

TI-2024-32946 CVE-2024-49358

ZimaOS vulnerable to Username Enumeration via API Responses

MEDIUM 63

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00475 Published 2024-10-24 No fix listed CWE-203

TI-2024-32627 CVE-2024-48932

ZimaOS Unauthenticated API Discloses Usernames

MEDIUM 63

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00518 Published 2024-10-24 Fixed in 1.5.0 CWE-284

TI-2025-36192 CVE-2025-58432

ZimaOS Privilege Escalation using localhost calls to File API Upload

MEDIUM 57

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 4.0MEDIUM 5.2 Local No auth User interaction EPSS 0.0018 Published 2025-09-17 No fix listed CWE-250

TI-2025-36191 CVE-2025-58431

ZimaOS reads arbitrary files using localhost calls to File API Download

MEDIUM 55

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 4.0MEDIUM 4.8 Local No auth No interaction EPSS 0.00205 Published 2025-09-17 No fix listed CWE-250

TI-2026-22992 CVE-2026-28798

Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS

MEDIUM 43

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00394 Published 2026-04-03 Fixed in 1.5.3 CWE-918

TI-2026-22593 CVE-2026-28286

ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

MEDIUM 43

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00467 Published 2026-03-02 No fix listed CWE-73

TI-2025-39840 CVE-2025-64427

ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)

LOW 31

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00271 Published 2026-03-02 Fixed in 1.5.0 CWE-200

Open these records in search →