InfoSecBulletin Cybersecurity for mankind
Zimbra has launched updates to fix serious security flaws, including a command injection bug in the SNMP monitoring part. As many as nine security flaws have been fixed in Zimbra 10.1.20. The biggest issue is a command injection problem in the SNMP monitoring part when SNMP alerts are turned on.
Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client:
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
An XSS vulnerability where a crafted field could execute a malicious script when rendered.
An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Fixes have come out for a flaw that lets users get around mail forwarding limits (CVE-2026-50055). This could let logged-in users steal emails even when mail forwarding is turned on. Jonah Burgess from Rapid7 found and reported this issue.
The company did not share any additional specifics, stating “in line with industry best practices, information disclosure is limited for security vulnerability fixes.”
The release comes a little over a week after Zimbra fixed a serious stored XSS problem in the Classic Web Client that could let attackers run any code.
None of the known problems have been marked as used right now, but bad people have often used XSS bugs in the email software before. It is very important for customers to install the updates to stay safe.
