Stored XSS vulnerability in OAuth configuration form

SNMP trap injection in zabbix_trap_receiver.pl

Active agent heartbeat missing TLS check

Hidden host credentials inferable via multiselect.get filtering

Server DoS via binary items

JavaScript preprocessing memory disclosure

Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

Server DoS via JavaScript preprocessing or script items

Host PSK extraction in Zabbix API

Use-after-free read in script item/preprocessing HttpRequest body

Frontend DoS via the validate.api.exists action

Hardcoded session key in Zabbix 7.4

Frontend plaintext macro value enumeration via the validatate.api.exists action

Frontend DoS via the popup.testtriggerexpr action

Prototype pollution leading to stored XSS

API and Frontend login lockout race condition

Email media OAuth secret leak to Super Admin

Stored XSS vulnerability in the Item history/Plain text widget

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

Stored XSS vulnerability in Host navigator widget maintenance tooltip

Agent 2 Docker plugin arbitrary file read via Docker API injection

Unauthenticated arbitrary PHP class instantiation

Blind, read-only SQL injection in Zabbix API via sortfield parameter

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

Frontend DoS vulnerability due to asymmetric resource consumption

Agent builds for AIX vulnerable to library loading hijacking

Frontend arbitrary file read in oauth.authorize action

Insufficient permission check for the problem.view.refresh action