Priority HIGH 70
Zulip server provides an open-source team chat that helps teams stay productive and focused.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00587 · Published 2025-01-16 · Fixed in 9.4 CWE-200
Priority MEDIUM 63
Zulip is an open-source team collaboration tool.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-04-03 · Fixed in 11.6 CWE-862
Priority MEDIUM 60
Zulip is an open-source team collaboration tool.
CVSS 3.1MEDIUM 6.1· Local · No auth · User interaction · EPSS 0.00246 · Published 2026-04-03 · Fixed in 11.6 CWE-22
Priority MEDIUM 56
Zulip is an open-source team collaboration tool.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05386 · Published 2022-01-25 · Fixed in 4.9 CWE-338
Priority MEDIUM 50
Zulip is an open-source team collaboration tool with topic-based threading.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01206 · Published 2022-02-25 · Fixed in 4.10 CWE-284
Priority MEDIUM 48
Zulip is an open-source team collaboration tool with unique topic-based threading.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00563 · Published 2023-05-19 · No fix listed CWE-862
Priority MEDIUM 48
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0317 · Published 2021-02-05 · No fix listed
Priority MEDIUM 47
Zulip is an open-source team collaboration tool.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0039 · Published 2026-10-14 · Fixed in 12.2 CWE-287
Priority MEDIUM 45
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that als…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01352 · Published 2019-11-21 · No fix listed
Priority MEDIUM 42
Zulip is an open-source team collaboration tool.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00361 · Published 2025-04-16 · Fixed in 10.2 CWE-287
Priority MEDIUM 40
Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0059 · Published 2024-11-29 · No fix listed CWE-125
Priority MEDIUM 40
Zulip is an open source team chat tool.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00823 · Published 2022-07-22 · Fixed in 5.5 CWE-285
Priority MEDIUM 40
Improper Access Control in GitHub repository zulip/zulip prior to 4.10.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00838 · Published 2022-02-26 · Fixed in 4.10 CWE-284
Priority MEDIUM 40
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01208 · Published 2020-08-21 · No fix listed CWE-94
Priority MEDIUM 40
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01087 · Published 2017-11-27 · Fixed in 1.7.1 CWE-863
Priority LOW 39
Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01143 · Published 2022-08-29 · Fixed in 27.190 CWE-184
Priority LOW 37
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful.
CVSS 3.1HIGH 8.2· Network · Low privileges · User interaction · EPSS 0.00617 · Published 2023-05-30 · Fixed in 7.0-beta3 CWE-79
Priority LOW 35
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00891 · Published 2020-08-21 · No fix listed CWE-269
Priority LOW 34
Zulip is an open source group chat application.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00955 · Published 2022-03-16 · Fixed in 4.11 CWE-362
Priority LOW 34
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00767 · Published 2022-07-28 · No fix listed CWE-284
Priority LOW 32
Zulip is an open source team chat server.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01737 · Published 2021-10-07 · Fixed in 4.7 CWE-1333
Priority LOW 31
Zulip is an open-source team collaboration tool.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00705 · Published 2026-11-04 · Fixed in 12.2 CWE-862
Priority LOW 31
Zulip is an open-source team collaboration tool.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.0031 · Published 2026-02-26 · No fix listed CWE-863
Priority LOW 31
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01249 · Published 2019-09-18 · No fix listed CWE-1333
Priority LOW 31
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Z…
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01278 · Published 2017-06-02 · No fix listed CWE-285
Load more