CVE-2026-23938

MediumCVSS 4.9/10Last modified Sep 23, 2026

Description

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2026
Last modified
Sep 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-239397.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.LocalCVE-2026-23946.5Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext ProfessionalCVE-2026-239406.5Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can causeCVE-2026-239419.4Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP RequestCVE-2026-239425.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path TrCVE-2026-239435.3Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of ServCVE-2026-239449.8Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests coulCVE-2026-239466.8Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below iCVE-2026-239479.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.CVE-2026-239487.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logoCVE-2026-239498.6jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulCVE-2026-23959.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology I