en
The ZoneMinder project develops ZoneMinder, free and open-source video-surveillance software for Linux. Its software supports IP, USB, and analog cameras and provides video capture, analysis, recording, and monitoring for closed-circuit television deployments.
As of 10/09/2026, ZoneMinder recorded 6 security vulnerabilities in the last 90 days across 1 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, zoneminder had the most security vulnerabilities in the ZoneMinder ecosystem, with 6 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-102297ZoneMinder before 1.38.4 Incorrect Authorization in frames API indexCVE-2026-102296ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera ResponseCVE-2024-58386ZoneMinder 1.37.x Path Traversal via files viewCVE-2026-54258Cross-monitor event media authorization bypass in direct event media endpointsCVE-2026-76060OS Command Injection in PayRange API| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-102297ZoneMinder before 1.38.4 Incorrect Authorization in frames API index | Exploitation statusActively exploited | FixYes | Affected productzoneminder | Published09/28/2026 | SeverityMedium |
CVE-2026-102296ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response | Exploitation statusActively exploited | FixYes | Affected productzoneminder | Published | |
CVE-2024-58386ZoneMinder 1.37.x Path Traversal via files view | Exploitation statusNot exploited | FixYes | Affected productzoneminder | Published09/28/2026 | |
CVE-2026-54258Cross-monitor event media authorization bypass in direct event media endpoints | Exploitation statusActively exploited | FixNo | Affected productzoneminder | ||
CVE-2026-76060OS Command Injection in PayRange API | Exploitation statusNot exploited | FixYes | Affected productzoneminder | Published08/27/2026 | |
CVE-2026-72556ZoneMinder ZoneMinder - Remote Code Execution | Exploitation statusNot exploited | FixNo | Affected productzoneminder | Published08/11/2026 | |
CVE-2026-27470ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields | Exploitation statusActively exploited | FixNo | Affected productzoneminder | Published | |
CVE-2025-65791CVE-2025-65791 | Exploitation statusActively exploited | FixNo | Affected product- | Published02/18/2026 | SeverityCritical |
CVE-2024-51482Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 | Exploitation statusActively exploited | FixYes | Affected productzoneminder | Published10/31/2024 | |
CVE-2023-31493CVE-2023-31493 | Exploitation statusActively exploited | FixNo | Affected product- | Published10/15/2024 | SeverityMedium |
92 Results | Page 1 of 10
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityCritical |