Synacor Zimbra Mail Client 8.6 prior to 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
synacor zimbra collaboration suite 8.6.0