Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-53413exploit | 8.3 high | 0.00% | no CPE yet | Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access. | Sat 24 Oct |
| CVE-2025-58132 | 6.5 medium | 2.0% | zoom, meeting_software_development_kit, rooms, workplace_desktop | Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. | 8 Oct |
| CVE-2026-53412 | 9.8 critical | 1.0% | zoom, workplace_desktop, workplace_virtual_desktop_infrastructure | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access. | Sat 24 Oct |
| CVE-2026-53407 | 9.8 critical | 0.00% | zoom, workplace | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access. | Sun 25 Oct |
| CVE-2025-64741 | 9.8 critical | 0.00% | zoom, meeting_software_development_kit, workplace | Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. | 18 Oct |
| CVE-2026-53415 | 8.3 high | 0.00% | no CPE yet | Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access. | Sat 24 Oct |
| CVE-2026-53408 | 8.1 high | 0.00% | zoom, meeting_software_development_kit, workplace | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access. | Mon 26 Oct |
| CVE-2026-53418 | 8.1 high | 0.00% | no CPE yet | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access. | 14 Oct |
| CVE-2026-53420 | 8.0 high | 0.00% | no CPE yet | Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. | 14 Oct |
| CVE-2023-34119 | 7.8 high | 0.00% | zoom, rooms | Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. | 12 h ago |
| CVE-2026-30905 | 7.8 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access. | Mon 26 Oct |
| CVE-2026-30906 | 7.8 high | 0.00% | zoom, rooms | Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access. | Mon 26 Oct |
| CVE-2026-53406 | 7.8 high | 0.00% | zoom, remote_control | Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access. | Mon 26 Oct |
| CVE-2026-53409 | 7.8 high | 0.00% | zoom, rooms | Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access. | Sat 24 Oct |
| CVE-2025-64740 | 7.8 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access. | 18 Oct |
| CVE-2026-91792 | 7.8 high | 0.00% | foxit, pdf_editor, pdf_reader | When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash. | 8 Oct |
| CVE-2025-64739 | 7.5 high | 0.00% | zoom, meeting_software_development_kit, rooms, rooms_controller | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. | 18 Oct |
| CVE-2025-58133 | 7.5 high | 0.00% | zoom, rooms | Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access. | 8 Oct |
| CVE-2026-108185 | 7.4 high | 0.00% | no CPE yet | Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access. | 15 Oct |
| CVE-2026-108184 | 7.4 high | 0.00% | no CPE yet | Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. | 15 Oct |
| CVE-2026-53416 | 7.1 high | 0.00% | no CPE yet | Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access. | Sat 24 Oct |
| CVE-2026-53410 | 7.0 high | 0.00% | zoom, remote_control_for_zoom_contact_center, rooms, workplace_desktop | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. | Sat 24 Oct |
| CVE-2026-53411 | 7.0 high | 0.00% | zoom, workplace_virtual_desktop_infrastructure | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. | Sat 24 Oct |
| CVE-2026-116516 | 6.5 medium | 0.00% | no CPE yet | Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723 | Mon 26 Oct |
| CVE-2026-53414 | 6.5 medium | 0.00% | no CPE yet | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access. | Sat 24 Oct |
| CVE-2026-66641 | 6.5 medium | 0.00% | no CPE yet | Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions. | Thu 22 Oct |
| CVE-2026-109590 | 6.4 medium | 0.00% | no CPE yet | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 17 h ago |
| CVE-2025-64738 | 5.5 medium | 0.00% | zoom, meeting_software_development_kit, workplace_desktop | External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access. | 18 Oct |
| CVE-2026-114175 | 5.4 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1. | Thu 22 Oct |
| CVE-2026-28169 | 5.3 medium | 0.00% | no CPE yet | Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. | Fri 23 Oct |
| CVE-2026-105814 | 5.3 medium | 0.00% | no CPE yet | TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session. Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality. | 20 Oct |
| CVE-2025-11760 | 5.3 medium | 0.00% | no CPE yet | The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access. | 8 Oct |
| CVE-2026-30904 | 4.3 medium | 0.00% | zoom, workplace | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access. | Mon 26 Oct |
| CVE-2026-114176 | 4.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1. | Thu 22 Oct |
| CVE-2026-101146 | 2.1 low | 0.00% | no CPE yet | A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | 20 Oct |
| CVE-2026-101143 | 2.1 low | 0.00% | no CPE yet | A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | 20 Oct |
36 of 36
Download these 36 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.