Checkmk

Latest CVEs · RSS

• CVE-2026-14452 2026-10-16 · CVSS 8.6
  Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to exec
• CVE-2026-105331 2026-10-08 · CVSS 5.2
  Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracl
• CVE-2026-90990 2026-09-22 · CVSS 5.3
  Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject ad
• CVE-2026-92882 2026-09-22 · CVSS 2.3
  Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) a
• CVE-2026-77021 2026-09-21 · CVSS 5.3
  Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a ho
• CVE-2026-15937 2026-09-04 · CVSS 5.3
  Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenti
• CVE-2026-17548 2026-08-25 · CVSS 5.3
  Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to vie
• CVE-2026-15576 2026-08-21 · CVSS 6.9
  Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verificatio
• CVE-2026-7485 2026-08-20 · CVSS 2.3
  Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted
• CVE-2026-15227 2026-07-31 · CVSS 5.3
  Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to
• CVE-2026-8593 2026-07-21 · CVSS 5.3
  Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without per
• CVE-2026-14852 2026-07-14 · CVSS 5.2
  Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to
• CVE-2026-9549 2026-06-08 · CVSS 4.8
  Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrat
• CVE-2026-8833 2026-06-08 · CVSS 8.5
  Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an au
• CVE-2026-8078 2026-06-08 · CVSS 4.8
  Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can
• CVE-2026-7765 2026-06-08 · CVSS 6.3
  Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messag
• CVE-2026-7186 2026-06-08 · CVSS 8.5
  Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing p
• CVE-2024-47091 2026-05-13 · CVSS 5.2
  Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a
• CVE-2026-33457 2026-04-10 · CVSS 5.3
  Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus comm
• CVE-2026-33456 2026-04-10 · CVSS 5.1
  Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to i
• CVE-2026-33455 2026-04-10 · CVSS 5.3
  Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due t
• CVE-2025-39666 2026-04-07 · CVSS 9.3
  Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows
• CVE-2026-3466 2026-04-07 · CVSS 8.5
  Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5
• CVE-2026-24096 2026-04-01 · CVSS 5.3
  Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 a
• CVE-2026-20915 2026-03-31 · CVSS 8.5
  Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject