CVE Feed

    Dashboard / CVE / CVE-2026-59782

    CVE-2026-59782

    The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.

    Published:Oct 5, 2026
    Last Modified:Oct 5, 2026
    EPS:Oct 5, 2026
    EPSS Score:
    CVSS Score:6.9

    Affected Products

    Vendor
    Zabbix
    Product
    Zabbix

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-59788 (CVSS 5.7) — The email media type OAuth form passes the Authorization endpoint value to window.open() without validating th…
    CVE-2026-59787 (CVSS 5.3) — The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimit…
    CVE-2026-59786 (CVSS 6.9) — Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certific…
    CVE-2026-59785 (CVSS 5.1) — Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK crede…
    CVE-2026-59783 (CVSS 2.3) — The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte…
    CVE-2026-59781 (CVSS 5.4) — When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify …
    CVE-2026-23938 (CVSS 2.1) — An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted prepro…
    CVE-2026-23937 (CVSS 6) — The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to …
    CVE-2026-23935 (CVSS 6.8) — A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (…
    CVE-2026-23934 (CVSS 5.1) — An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specific…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High