CVE-2025-27442

Zoom Workplace Apps - Cross Site Scripting

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-27441

Zoom Workplace Apps - Cross Site Scripting

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-30663

Zoom Workplace Apps - Time-of-check Time-of-use

Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-30664

Zoom Workplace Apps - Cross-site Scripting

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-49457

Zoom Clients for Windows - Untrusted Search Path

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 4 more

CVE-2025-62483

Zoom Clients - Improper Removal of Sensitive Information

Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 4 more

CVE-2025-64739

Zoom Clients - External Control of File Name or Path

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 4 more

CVE-2025-46786

Zoom Workplace Apps - Cross-site Scripting

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-30667

Zoom Workplace Apps - NULL Pointer Dereference

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-30668

Zoom Workplace Apps - NULL Pointer Dereference

Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-0151

Zoom Apps - Use After Free

Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 4 more

CVE-2025-27439

Zoom Apps - Buffer Underflow

Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-27440

Zoom Apps - Heap-based Buffer Overflow

Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-49458

Zoom Workplace Clients - Buffer Overflow

Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 5 more

CVE-2025-49460

Zoom Workplace Clients - Argument Injection

Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 5 more

CVE-2024-42434

Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization

Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more

CVE-2025-58135

Zoom Workplace Clients for Windows - Improper Action Enforcement

Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Zoom

Products

Windows Meeting Software Development Kit Rooms and 6 more

CVE-2025-58134

Zoom Workplace Clients for Windows - Incorrect Authorization

Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Zoom

Products

Windows Meeting Software Development Kit Rooms and 6 more

CVE-2025-49461

Zoom Workplace Clients - Cross-site Scripting

Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 5 more

CVE-2024-39824

Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization

Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meeting Software Development Kit Rooms Rooms Controller and 3 more