Vendor

Zimbra

Vulnerabilities, patches, and vendor advisories affecting Zimbra Collaboration Suite — the Classic Web Client, Modern UI, and mailboxd server components — plus the operational impact of Zimbra patch cycles on the organizations still self-hosting webmail.

Articles

~/articles/2026-07-11-zimbra-10-1-19-classic-web-client-xss-google-tag

zimbra

Zimbra ships 10.1.19; Google TAG reported the XSS

Zimbra 10.1.19 patches a stored XSS in the Classic Web Client. No CVE yet, no confirmed exploitation — Google TAG reported it, which is the reason to patch now.

Jul 11 read →