Priority MEDIUM 63
Zulip is an open-source team collaboration tool.
zulip
Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9
Exploited now
zulip records in CISA KEVNo zulip vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
20 records in Zulip · all components
TI-2026-21062 CVE-2026-26058
Zulip: Path Traversal in Import
Priority MEDIUM 60
Zulip is an open-source team collaboration tool.
Priority MEDIUM 56
Zulip is an open-source team collaboration tool.
TI-2023-15953 CVE-2023-32677
Users who can send invitations can erroneously add users to streams during invitation in Zulip
Priority MEDIUM 48
Zulip is an open-source team collaboration tool with unique topic-based threading.
Priority MEDIUM 40
Zulip is an open source team chat tool.
TI-2021-02864 CVE-2021-3967 · GHSA-2xp9-33rm-wcwv
Improper Access Control in zulip/zulip
Priority MEDIUM 40
Improper Access Control in GitHub repository zulip/zulip prior to 4.10.
Priority LOW 39
Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users.
TI-2022-08565 CVE-2022-24751
Race condition in Zulip
Priority LOW 34
Zulip is an open source group chat application.
TI-2016-03803 CVE-2016-4427 · GHSA-58ww-8hxm-f99f
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
Priority LOW 34
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
TI-2021-17954 CVE-2021-41115
Regular expression denial-of-service in Zulip
Priority LOW 32
Zulip is an open source team chat server.
Priority LOW 30
Zulip is an open source group chat application that combines real-time chat with threaded conversations.
TI-2023-13143 CVE-2023-28623
Unauthorized user can register an account in specific configurations in Zulip
Priority LOW 29
Zulip is an open-source team collaboration tool with unique topic-based threading.
TI-2024-24357 CVE-2024-36625 · GHSA-xxvh-8h9p-mpwj
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.
Priority LOW 27
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.
TI-2024-24356 CVE-2024-36624 · GHSA-49pw-2xfg-hw49
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.
Priority LOW 27
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.
TI-2021-02796 CVE-2021-3866 · GHSA-c9g2-65fq-w8q5
Cross-site Scripting (XSS) - Stored in zulip/zulip
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
TI-2025-30323 CVE-2025-47930
Zulip Server has access control bypass for restrictions on creation of specific channel types
Priority LOW 24
Zulip is an open-source team chat application.
Priority LOW 21
Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.
TI-2016-03802 CVE-2016-4426 · GHSA-xv4m-3w46-f9wh
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
Priority LOW 21
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
TI-2025-21674 CVE-2025-30368
Zulip allows the deletion of organization by administrators of a different organization
Priority LOW 14
Zulip is an open-source team collaboration tool.
Priority LOW 14
Zulip is an open-source team collaboration tool.