Threat database

CVE-2026-108185 is a high-severity vulnerability in Zoom Clients involving improper certificate validation in the My Notes feature. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction or privileges but has a high attack complexity. No patch or remediation details are provided in the available data.

CVE-2026-108184 is a high-severity vulnerability in certain Zoom Clients for Windows involving improper certificate validation. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction and has a high impact on confidentiality. No affected versions or patch information are provided in the available data.

CVE-2026-53420 is a buffer overflow vulnerability in the Zoom Phone feature of Zoom Workplace Clients. It may allow an unauthenticated attacker to escalate privileges via network access. The vulnerability affects versions prior to 7.2.0. The CVSS score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-53418 is a high-severity vulnerability in Zoom Workplace for Android before version 7.2.1. It involves improper authorization in the handler for a custom URL scheme, which may allow an unauthenticated user to escalate privileges via network access. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No known exploits are reported in the wild. The issue is fixed in version 7.2.1.

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

CVE-2026-53412 is a critical vulnerability in Zoom Workplace for Windows and related Zoom clients that involves improper input validation. This flaw may allow an unauthenticated attacker with network access to take over user accounts. The vulnerability affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. No specific affected versions or patches have been confirmed yet. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.

CVE-2026-53411 is a high-severity vulnerability in the Zoom Workplace VDI Plugin for Windows. It involves a time-of-check to time-of-use (TOCTOU) race condition during the installation and uninstallation processes. This flaw could allow an authenticated local user to escalate privileges on the affected system. No specific affected versions or patches have been disclosed yet.

CVE-2026-53410 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the installation and uninstallation process of certain Zoom Clients for Windows. This flaw could allow an authenticated local user to escalate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patches have been disclosed yet.

CVE-2026-53409 is a high-severity vulnerability in Zoom Communications Zoom Rooms for Windows prior to version 7.1.0. It involves improper privilege management that may allow an authenticated local user to escalate their privileges. The vulnerability is classified under CWE-20 (Improper Input Validation). No patch or official remediation guidance is currently provided by the vendor.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.

CVE-2026-53407 is a high-severity vulnerability in Zoom Communications' Zoom Workplace application affecting versions before 7.0.4 on Android and before 7.0.3 on iOS. It involves improper authorization in the handler for a custom URL scheme, which may allow an unauthenticated user to escalate privileges via network access. The vulnerability has a CVSS score of 8.1, indicating a significant risk to confidentiality and integrity without impacting availability. No official patch or vendor advisory is provided in the data. No known exploits in the wild have been reported.

CVE-2026-53406 is a high-severity vulnerability in Zoom Communications' Remote Control for Zoom Contact Center for Windows versions prior to 7.0.0. It involves insufficient verification of data authenticity, which may allow an authenticated local user to escalate privileges. The vulnerability has a CVSS 3.1 base score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2026-30904 is a low-severity vulnerability in Zoom Workplace for iOS versions before 7.0.0. It involves a protection mechanism failure that may allow an authenticated user with physical access to the device to disclose information. The vulnerability does not affect confidentiality broadly, nor does it impact integrity or availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.