Checkmk GmbH

Products

Exploited and recent CVEs

• CVE-2026-117611 High 7.1 Trust of compromised eMudhra root CA in bundled CA stores 0.2%
• CVE-2026-113461 Medium 5.2 mk-oracle: Local privilege escalation via insecure Oracle Home library loading 0.1%
• CVE-2026-14452 High 8.6 Open redirect and XSS via reset_url parameter 0.3%
• CVE-2026-105331 Medium 5.2 mk-oracle: Local privilege escalation via malicious Oracle Instant Client <0.1%
• CVE-2026-90990 Medium 5.3 Livestatus injection via monitoring filter values 0.4%
• CVE-2026-92882 Low 2.3 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses 0.4%
• CVE-2026-77021 Medium 5.3 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data 0.4%
• CVE-2026-15937 Medium 5.3 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint 0.2%
• CVE-2026-17548 Medium 5.3 Missing authorization for viewing background jobs 0.4%
• CVE-2026-15576 Medium 6.9 Agent receiver accepts mTLS requests without a client certificate 0.5%
• CVE-2026-7485 Low 2.3 Frozen BI aggregations leak host and service names to unauthorized users 0.4%
• CVE-2026-15227 Medium 5.3 Missing Authorization Allows Editing of Foreign Reports 0.4%
• CVE-2026-8593 Medium 5.3 Fix Business Intelligence API Pack permission 0.4%
• CVE-2026-14852 Medium 5.2 mk_sap_hana: Privilege escalation via crafted sapstartsrv process name 0.2%
• CVE-2026-9549 Medium 4.8 Fix XSS in service discovery active check output 0.1%
• CVE-2026-8833 High 8.5 XSS in urls 0.1%
• CVE-2026-8078 Medium 4.8 Fix stored XSS in global settings change log 0.1%
• CVE-2026-7765 Medium 6.3 User Messages widget leaked issuer messages on shared dashboards 0.2%
• CVE-2026-7186 High 8.5 Fix stored XSS in URL dashboard widget via dangerous URI schemes 0.1%
• CVE-2024-47091 Medium 5.2 Privilege escalation via mk_mysql agent plugin on Windows 0.1%
• CVE-2026-33457 Medium 5.3 Potential livestatus injection in prediction graph page 0.2%
• CVE-2026-33456 Medium 5.1 Potential livestatus injection in notification test 0.2%
• CVE-2026-33455 Medium 5.3 Livestatus injection in monitoring quicksearch 0.2%
• CVE-2025-39666 Critical 9.3 omd: Local privilege escalation when executing omd commands as root 0.1%
• CVE-2026-3466 High 8.5 Cross-site scripting in dashlet title 0.2%
• CVE-2026-24096 Medium 5.3 Insufficient permission validation on multiple REST API Quick Setup endpoints 0.2%
• CVE-2026-20915 High 8.5 Stored cross-site scripting in Pending Changes sidebar 0.2%
• CVE-2026-33276 High 8.6 XSS in Unified Search via Unescaped Host/Service Names 0.1%
• CVE-2025-64998 High 7.3 Session hijacking via exposed session signing secret in distributed Checkmk setups 0.3%
• CVE-2026-2859 Medium 6.3 Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint 0.2%