CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,476
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product checkmk:checkmk. Show all products

38 CVEs, showing 1 to 38
CVESeverityTitlePublished
CVE-2026-14452High 8.6Open redirect and XSS via reset_url parameter
Assigned by Checkmk
Oct 16, 2026
CVE-2026-105331Medium 5.2mk-oracle: Local privilege escalation via malicious Oracle Instant Client
Assigned by Checkmk
Oct 8, 2026
CVE-2026-90990Medium 5.3Livestatus injection via monitoring filter values
Assigned by Checkmk
Sep 22, 2026
CVE-2026-92882Low 2.3Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
Assigned by Checkmk
Sep 22, 2026
CVE-2026-77021Medium 5.3Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
Assigned by Checkmk
Sep 21, 2026
CVE-2026-15937Medium 5.3Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
Assigned by Checkmk
Sep 4, 2026
CVE-2026-17548Medium 5.3Missing authorization for viewing background jobs
Assigned by Checkmk
Aug 25, 2026
CVE-2026-15576Medium 6.9Agent receiver accepts mTLS requests without a client certificate
Assigned by Checkmk
Aug 21, 2026
CVE-2026-7485Low 2.3Frozen BI aggregations leak host and service names to unauthorized users
Assigned by Checkmk
Aug 20, 2026
CVE-2026-15227Medium 5.3Missing Authorization Allows Editing of Foreign Reports
Assigned by Checkmk
Jul 31, 2026
CVE-2026-9549Medium 4.8Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom c…Jun 8, 2026
CVE-2026-8833Medium 5.4Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validati…Jun 8, 2026
CVE-2026-8078Medium 4.8Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicio…Jun 8, 2026
CVE-2026-7765Medium 5.3Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing a…Jun 8, 2026
CVE-2026-7186Medium 5.4Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a danger…Jun 8, 2026
CVE-2024-47091High 7.8Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MyS…May 13, 2026
CVE-2026-33457Medium 6.3Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name paramet…Apr 10, 2026
CVE-2026-33456High 7.6Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via…Apr 10, 2026
CVE-2026-33455Medium 6.3Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in se…Apr 10, 2026
CVE-2026-3466Medium 5.4Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attack…Apr 7, 2026
CVE-2025-39666High 7.3Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privilege…Apr 7, 2026
CVE-2026-24096High 8.8Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform u…Apr 1, 2026
CVE-2026-33276Medium 5.4Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of othe…Mar 31, 2026
CVE-2026-20915Medium 5.4Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending C…Mar 31, 2026
CVE-2025-64998High 7.2Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging sessio…Mar 24, 2026
CVE-2026-2859Medium 4.3Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP…Mar 13, 2026
CVE-2026-24097Medium 4.3Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP re…Mar 13, 2026
CVE-2026-3103Medium 5.4A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.Mar 4, 2026
CVE-2025-64999Medium 5.4Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check output to inject malicious JavaScript into…Feb 26, 2026
CVE-2025-65000Medium 5.3SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all versions of Checkmk 2.3.0.Dec 18, 2025
CVE-2025-64997Medium 6.5Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.Dec 18, 2025
CVE-2025-64996Medium 4.4In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writable files, allowing any local user on the system to read th…Nov 18, 2025
CVE-2025-58122Medium 5.4Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or…Nov 18, 2025
CVE-2025-58121Medium 5.4Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to perform unauthorized actions or obtain sens…Nov 18, 2025
CVE-2025-39663High 8.4Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site.Oct 30, 2025
CVE-2025-39664Medium 6.5Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the storage location of report file pairs beyond…Oct 9, 2025
CVE-2025-32919High 7.8Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation.Oct 9, 2025
CVE-2025-32916Medium 4.3Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive form data to be included in URL query pa…Oct 9, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.