Zoneminder vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-30971 ZoneMinder is a free, open source closed-circuit television software application.High 8.8 · Oct 16, 2026
• CVE-2026-102608 ZoneMinder is a free, open source closed-circuit television software application.Critical 9 · Oct 16, 2026
• CVE-2026-102607 ZoneMinder is a free, open source closed-circuit television software application.High 8.8 · Oct 16, 2026
• CVE-2026-102296 ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting atHigh 8.3 · Sep 28, 2026
• CVE-2024-58386 ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files.High 7.1 · Sep 28, 2026
• CVE-2026-76060 An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality.High 8.7 · Aug 27, 2026
• CVE-2026-72556 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the High 8.8 · Aug 11, 2026
• CVE-2026-27470 ZoneMinder is a free, open source closed-circuit television software application.High 8.8 · Feb 21, 2026
• CVE-2025-65791 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.Critical 9.8 · Feb 18, 2026
• CVE-2024-51482 ZoneMinder is a free, open source closed-circuit television software application.Critical 9.9 · Oct 31, 2024
• CVE-2024-43360 ZoneMinder is a free, open source closed-circuit television software application.Critical 9.8 · Aug 12, 2024
• CVE-2023-41884 ZoneMinder is a free, open source Closed-circuit television software application.High 7.1 · Aug 12, 2024
• CVE-2020-25730 Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sHigh 8.2 · Apr 4, 2024
• CVE-2023-26039 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 7.1 · Feb 24, 2023
• CVE-2023-26037 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 8.9 · Feb 24, 2023
• CVE-2023-26036 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 8.1 · Feb 24, 2023
• CVE-2023-26035 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 7.2 · Feb 24, 2023
• CVE-2023-26034 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Critical 9.6 · Feb 24, 2023
• CVE-2023-26032 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 8.9 · Feb 24, 2023
• CVE-2023-25825 ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.High 7.7 · Feb 24, 2023
• CVE-2022-39290 ZoneMinder is a free, open source Closed-circuit television software application.High 8 · Oct 7, 2022
• CVE-2022-39289 ZoneMinder is a free, open source Closed-circuit television software application.Critical 9.1 · Oct 7, 2022
• CVE-2022-39285 ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) High 7.6 · Oct 7, 2022
• CVE-2022-29806 ZoneMinder before 1.36.13 allows remote code execution via an invalid language.Critical 9.8 · Apr 26, 2022
• CVE-2019-8429 ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.Critical 9.8 · Feb 17, 2019