Stories tagged: #zimbra

> Jul 21, 2026#zimbra #cve

Zimbra 10.1.20 patches critical command injection plus three CVEs

Zimbra shipped Daffodil 10.1.20 with a critical command injection in the SNMP monitor, four Classic UI XSS bugs, an SSRF in Nextcloud, and CVE-2026-50055 / CVE-2026-10631 / CVE-2026-50054.

> Jul 13, 2026#zimbra #xss

Zimbra 10.1.19 patches Classic Web Client stored XSS, TAG-reported

Zimbra shipped Daffodil 10.1.19 on July 7 to fix a stored XSS in the Classic Web Client where a crafted email runs JavaScript in the recipient's mailbox session. Reporter: Google TAG. No CVE assigned.