net-mgmt/zabbix74-server: Update to 7.4.15 Release notes: https://www.zabbix.com/rn/rn7.4.159a150319ce
Port details
net-mgmt/zabbix74-proxy 7.4.15
Enterprise-class open source distributed monitoring (proxy)
- Maintainer
- otis@FreeBSD.org
- Packages
- latest: 7.4.16, update to 7.4.15 not built yet
- Upstream
- up to date
- Last update
- to 7.4.15 · 9a150319ce
- Quarterly
- 2026Q4: 7.4.15
- WWW
- https://www.zabbix.com/
- Links
- cgit · VuXML
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 7.4.16.Fixed (10)
Show 10 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-23929 | 8.5 | 2026-08-18 | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like … |
| CVE-2026-23933 | 7.7 | 2026-08-18 | In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario … |
| CVE-2026-1199 | 6.9 | 2026-08-18 | Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultane… |
| CVE-2026-23935 | 6.8 | 2026-08-18 | A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confide… |
| CVE-2026-23937 | 6.0 | 2026-08-18 | The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. |
| CVE-2026-23930 | 5.3 | 2026-08-18 | An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerex… |
| CVE-2026-23931 | 5.3 | 2026-08-18 | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. |
| CVE-2026-23934 | 5.1 | 2026-08-18 | An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists a… |
| CVE-2026-23938 | 2.1 | 2026-08-18 | An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potentia… |
| CVE-2026-23922 | 2.1 | 2026-08-18 | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to rese… |
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (5)
net-mgmt/zabbix74-proxy: Fix rc.d script After chasing MariaDB-related changes, proxy rc.d script was missed out. Fixes: 6ca0412c95f178157897c59
net-mgmt/zabbix74-server: Update to 7.4.9 Release notes: https://www.zabbix.com/rn/rn7.4.98765d76a3f
net-mgmt/zabbix*-server: Switch to respect DEFAULT_VERSIONS for MySQL To help tracking of default MySQL client version, switch the default MySQL requirement from fixed version (8.0, 8.4, ...) to DEFAULT_VERSIONS. Reported by: Simon Wright <simon.wright@gmx.net>bc4339d70e
net-mgmt/zabbix74: Add new ports Add zabbix74 ports, a Standard release. Its support will last until there will be 8.0 LTS release (at the latest in Q3/2026). The upgrade notes can be found at: https://www.zabbix.com/documentation/7.4/en/manual/installation/upgrade_notes_740 Release notes: https://www.zabbix.com/rn/rn7.4.0a669ab74cd