Checkmk GmbH Checkmk

• CVE-2026-117611 High 7.1 Trust of compromised eMudhra root CA in bundled CA stores 0.2%
• CVE-2026-113461 Medium 5.2 mk-oracle: Local privilege escalation via insecure Oracle Home library loading 0.1%
• CVE-2026-14452 High 8.6 Open redirect and XSS via reset_url parameter 0.3%
• CVE-2026-105331 Medium 5.2 mk-oracle: Local privilege escalation via malicious Oracle Instant Client <0.1%
• CVE-2026-90990 Medium 5.3 Livestatus injection via monitoring filter values 0.4%
• CVE-2026-92882 Low 2.3 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses 0.4%
• CVE-2026-77021 Medium 5.3 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data 0.4%
• CVE-2026-15937 Medium 5.3 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint 0.2%
• CVE-2026-17548 Medium 5.3 Missing authorization for viewing background jobs 0.4%
• CVE-2026-15576 Medium 6.9 Agent receiver accepts mTLS requests without a client certificate 0.5%
• CVE-2026-7485 Low 2.3 Frozen BI aggregations leak host and service names to unauthorized users 0.4%
• CVE-2026-15227 Medium 5.3 Missing Authorization Allows Editing of Foreign Reports 0.4%
• CVE-2026-8593 Medium 5.3 Fix Business Intelligence API Pack permission 0.4%
• CVE-2026-14852 Medium 5.2 mk_sap_hana: Privilege escalation via crafted sapstartsrv process name 0.2%
• CVE-2026-9549 Medium 4.8 Fix XSS in service discovery active check output 0.1%
• CVE-2026-8833 High 8.5 XSS in urls 0.1%
• CVE-2026-8078 Medium 4.8 Fix stored XSS in global settings change log 0.1%
• CVE-2026-7765 Medium 6.3 User Messages widget leaked issuer messages on shared dashboards 0.2%
• CVE-2026-7186 High 8.5 Fix stored XSS in URL dashboard widget via dangerous URI schemes 0.1%
• CVE-2024-47091 Medium 5.2 Privilege escalation via mk_mysql agent plugin on Windows 0.1%
• CVE-2026-33457 Medium 5.3 Potential livestatus injection in prediction graph page 0.2%
• CVE-2026-33456 Medium 5.1 Potential livestatus injection in notification test 0.2%
• CVE-2026-33455 Medium 5.3 Livestatus injection in monitoring quicksearch 0.2%
• CVE-2025-39666 Critical 9.3 omd: Local privilege escalation when executing omd commands as root 0.1%
• CVE-2026-3466 High 8.5 Cross-site scripting in dashlet title 0.2%
• CVE-2026-24096 Medium 5.3 Insufficient permission validation on multiple REST API Quick Setup endpoints 0.2%
• CVE-2026-20915 High 8.5 Stored cross-site scripting in Pending Changes sidebar 0.2%
• CVE-2026-33276 High 8.6 XSS in Unified Search via Unescaped Host/Service Names 0.1%
• CVE-2025-64998 High 7.3 Session hijacking via exposed session signing secret in distributed Checkmk setups 0.3%
• CVE-2026-2859 Medium 6.3 Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint 0.2%
• CVE-2026-24097 Medium 5.3 Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint 0.3%
• CVE-2026-3103 Medium 5.3 Deletion of passwords via RestApi 0.2%
• CVE-2025-64999 High 7.3 Cross-site scripting in HTML logs of Synthetic Monitoring test services 0.2%
• CVE-2026-24095 Medium 5.3 Missing Permission Check on Analyze Configuration Page 0.3%
• CVE-2025-65000 Low 2.3 Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule 0.2%
• CVE-2025-64997 Medium 6.3 Insufficient permission validation when showing agent information 0.2%
• CVE-2025-58121 Medium 5.3 Insufficient permission validation on multiple REST API endpoints 0.2%
• CVE-2025-58122 Medium 5.3 Insufficient permission validation when configuring notification parameters 0.2%
• CVE-2025-64996 Medium 4.8 Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output 0.1%
• CVE-2025-39663 High 8.5 Cross Site Scripting through compromised remote site 0.6%
• CVE-2025-39664 High 7.1 Path-Traversal in report scheduler 0.7%
• CVE-2025-32919 High 8.8 Privilege Escalation in Windows License plugin for Checkmk Windows Agent 0.3%
• CVE-2025-32916 Low 1.0 Sensitive form data in URL query parameters 0.2%
• CVE-2025-32918 Medium 5.3 Livestatus injection in autocomplete endpoint 0.4%
• CVE-2025-32915 Medium 4.3 Sensitive data exposed during automatic agent updates 0.1%
• CVE-2025-1712 High 8.7 Arbitrary file write with vcrtrace 0.8%
• CVE-2025-32917 Medium 5.2 Privilege escalation in jar_signature 0.3%
• CVE-2025-3506 Medium 6.3 Potentially senitive path exposed via unauthenticated http route 0.3%
• CVE-2025-2092 High 7.1 Remote site authentication secrets written to web log 0.3%
• CVE-2024-38865 Medium 6.0 Livestatus command injection in RestAPI 0.9%