InfoSecBulletin Cybersecurity for mankind
Zimbra has launched updates to fix serious security flaws, including a command injection bug in the SNMP monitoring part. As many as nine security flaws have been fixed in Zimbra 10.1.20. The biggest issue is a command injection problem in the SNMP monitoring part when SNMP alerts are turned on.
Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client:
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
An XSS vulnerability where a crafted field could execute a malicious script when rendered.
An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Fixes have come out for a flaw that lets users get around mail forwarding limits (CVE-2026-50055). This could let logged-in users steal emails even when mail forwarding is turned on. Jonah Burgess from Rapid7 found and reported this issue.
The company did not share any additional specifics, stating “in line with industry best practices, information disclosure is limited for security vulnerability fixes.”
The release comes a little over a week after Zimbra fixed a serious stored XSS problem in the Classic Web Client that could let attackers run any code.
None of the known problems have been marked as used right now, but bad people have often used XSS bugs in the email software before. It is very important for customers to install the updates to stay safe.
