Browse CVEs

MEDIUM 5.4 CVE-2026-7186 Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboar… Checkmk Mitigation only Fix from $1,6002026-06-08 MEDIUM 5.4 CVE-2026-8833 Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions a… Checkmk Mitigation only Fix from $1,6002026-06-08 MEDIUM 5.3 CVE-2026-7765 Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creat… Checkmk Mitigation only Fix from $1,6002026-06-08 HIGH 7.8 CVE-2024-47091 Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able t… Checkmk Mitigation only Fix from $1,9502026-05-13 HIGH 7.6 CVE-2026-33456 Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification tes… Checkmk Mitigation only Fix from $1,9502026-04-10 MEDIUM 6.3 CVE-2026-33457 Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Live… Checkmk Mitigation only Fix from $1,6002026-04-10 MEDIUM 6.3 CVE-2026-33455 Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search … Checkmk Mitigation only Fix from $1,6002026-04-10 MEDIUM 5.4 CVE-2026-3466 Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and … Checkmk Mitigation only Fix from $1,6002026-04-07 HIGH 7.3 CVE-2025-39666 Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.… Checkmk Mitigation only Fix from $1,9502026-04-07 HIGH 8.8 CVE-2026-24096 Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version… Checkmk Mitigation only Fix from $1,9502026-04-01 MEDIUM 5.4 CVE-2026-33276 Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to ex… Checkmk Mitigation only Fix from $1,6002026-03-31 MEDIUM 5.4 CVE-2026-20915 Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes… Checkmk Mitigation only Fix from $1,6002026-03-31 HIGH 7.2 CVE-2025-64998 Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hij… Checkmk Mitigation only Fix from $1,9502026-03-24 MEDIUM 5.4 CVE-2026-3103 A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user… Checkmk Mitigation only Fix from $1,6002026-03-04 MEDIUM 5.4 CVE-2025-64999 Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's… Checkmk Mitigation only Fix from $1,6002026-02-26 MEDIUM 5.3 CVE-2025-65000 SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all versions of C… Checkmk Mitigation only Fix from $1,6002025-12-18 MEDIUM 6.5 CVE-2025-64997 Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the RE… Checkmk Mitigation only Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2025-58122 Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the RES… Checkmk Mitigation only Fix from $1,6002025-11-18 HIGH 8.8 CVE-2025-32918 Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p… Checkmk Mitigation only Fix from $1,9502025-07-04 MEDIUM 5.5 CVE-2025-32915 Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42… Checkmk Mitigation only Fix from $1,6002025-05-22 HIGH 8.8 CVE-2025-32917 Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with writ… Checkmk Mitigation only Fix from $1,9502025-05-13 MEDIUM 5.5 CVE-2024-47094 Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets … Checkmk Mitigation only Fix from $1,6002024-11-29 HIGH 7.5 CVE-2024-38863 Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to … Checkmk Mitigation only Fix from $1,9502024-10-14 HIGH 8.8 CVE-2024-8606 Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication Checkmk Mitigation only Fix from $1,9502024-09-23 MEDIUM 6.1 CVE-2024-38860 Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phish… Checkmk Mitigation only Fix from $1,6002024-09-17 HIGH 7.4 CVE-2024-6572 Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2… Checkmk Mitigation only Fix from $1,9502024-09-09 MEDIUM 6.1 CVE-2024-38859 XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users… Checkmk Mitigation only Fix from $1,6002024-08-26 HIGH 7.8 CVE-2024-28829 Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.… Checkmk Mitigation only Fix from $1,9502024-08-20 MEDIUM 6.5 CVE-2024-6542 Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows arbitrary … Checkmk Mitigation only Fix from $1,6002024-07-22 HIGH 8.8 CVE-2024-28828 Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site. Checkmk Mitigation only Fix from $1,9502024-07-10