CVE Program partner

Zoom

Zoom Communications, Inc.

API
CVEs, 365 days34237 all time, 3 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationZoom Communications, Inc.
RoleCNA
TypeVendor
Reports tomitre
ScopeZoom and Keybase issues only.
Advisorieshttps://zoom.us/trust/security/security-bulletin

Latest CVEs · RSS

  • CVE-2026-108185 2026-10-13 · CVSS 7.4
    Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via netwo
  • CVE-2026-108184 2026-10-13 · CVSS 7.4
    Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
  • CVE-2026-53420 2026-10-13 · CVSS 8.0
    Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
  • CVE-2026-53418 2026-10-13 · CVSS 8.1
    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escal
  • CVE-2026-53416 2026-08-11 · CVSS 7.1
    Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.
  • CVE-2026-53415 2026-08-11 · CVSS 8.3
    Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network acc
  • CVE-2026-53414 2026-08-11 · CVSS 6.5
    Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on
  • CVE-2026-53413 2026-08-11 · CVSS 8.3
    Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution
  • CVE-2026-53412 2026-07-16 · CVSS 9.8
    Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to
  • CVE-2026-53411 2026-07-16 · CVSS 7.8
    A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authent
  • CVE-2026-53410 2026-07-16 · CVSS 7.0
    A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authent
  • CVE-2026-53409 2026-07-16 · CVSS 7.8
    Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local acc
  • CVE-2026-53408 2026-06-12 · CVSS 8.1
    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated
  • CVE-2026-53407 2026-06-12 · CVSS 8.1
    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated
  • CVE-2026-53406 2026-06-12 · CVSS 7.8
    Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to ena
  • CVE-2026-30906 2026-05-13 · CVSS 7.8
    Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via
  • CVE-2026-30905 2026-05-13 · CVSS 7.8
    External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to cond
  • CVE-2026-30904 2026-05-13 · CVSS 1.8
    Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical
  • CVE-2026-30903 2026-03-11 · CVSS 9.6
    External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation
  • CVE-2026-30902 2026-03-11 · CVSS 7.8
    Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
  • CVE-2026-30901 2026-03-11 · CVSS 7.0
    Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local a
  • CVE-2026-30900 2026-03-11 · CVSS 7.8
    Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privil
  • CVE-2026-22844 2026-01-20 · CVSS 9.9
    A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execut
  • CVE-2025-67460 2025-12-10 · CVSS 7.8
    Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privileg
  • CVE-2025-67461 2025-12-10 · CVSS 5.0
    External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via lo

All CVE Program partners