CVE-2026-23938

MediumCVSS 4.9/10Last modified Sep 23, 2026

Description

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
Zabbix	Zabbix	>= 6.0.0, <= 6.0.46; >= 7.0.0, <= 7.0.26; >= 7.4.0, <= 7.4.10

References

https://support.zabbix.com/browse/ZBX-28075Vendor Advisory

Timeline

Published: Aug 18, 2026
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239397.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local CVE-2026-23946.5Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional CVE-2026-239406.5Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause CVE-2026-239419.4Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request CVE-2026-239425.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Tr CVE-2026-239435.3Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Serv CVE-2026-239449.8Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests coul CVE-2026-239466.8Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below i CVE-2026-239479.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.CVE-2026-239487.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logo CVE-2026-239498.6jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vul CVE-2026-23959.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology I