CG
Vendor
Checkmk GmbH
45
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113461 | CH Checkmk Checkmk GmbH | 5.2 | Oct 21 | mk-oracle: Local privilege escalation via insecure Oracle Home library loading |
| CVE-2026-14452 | CH Checkmk Checkmk GmbH | 8.6 | Oct 16 | Open redirect and XSS via reset_url parameter |
| CVE-2026-105331 | CH Checkmk Checkmk GmbH | 5.2 | Oct 8 | mk-oracle: Local privilege escalation via malicious Oracle Instant Client |
| CVE-2026-90990 | CH Checkmk Checkmk GmbH | 5.3 | Sep 22 | Livestatus injection via monitoring filter values |
| CVE-2026-92882 | CH Checkmk Checkmk GmbH | 5.3 | Sep 22 | Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses |
| CVE-2026-77021 | CH Checkmk Checkmk GmbH | 5.3 | Sep 21 | Missing decompression size limit in agent receiver allows memory exhaustion via push agent data |
| CVE-2026-15937 | CH Checkmk Checkmk GmbH | 5.3 | Sep 4 | Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint |
| CVE-2026-17548 | CH Checkmk Checkmk GmbH | 5.3 | Aug 25 | Missing authorization for viewing background jobs |
| CVE-2026-15576 | CH Checkmk Checkmk GmbH | 6.9 | Aug 21 | Agent receiver accepts mTLS requests without a client certificate |
| CVE-2026-7485 | CH Checkmk Checkmk GmbH | 2.3 | Aug 20 | Frozen BI aggregations leak host and service names to unauthorized users |
| CVE-2026-15227 | CH Checkmk Checkmk GmbH | 5.3 | Jul 31 | Missing Authorization Allows Editing of Foreign Reports |
| CVE-2026-8593 | CH Checkmk Checkmk GmbH | 5.3 | Jul 21 | Fix Business Intelligence API Pack permission |
| CVE-2026-14852 | CH Checkmk Checkmk GmbH | 5.2 | Jul 14 | mk_sap_hana: Privilege escalation via crafted sapstartsrv process name |
| CVE-2026-9549 | CH Checkmk Checkmk GmbH | 4.8 | Jun 8 | Fix XSS in service discovery active check output |
| CVE-2026-8833 | CH Checkmk Checkmk GmbH | 5.4 | Jun 8 | Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validatio |
| CVE-2026-8078 | CH Checkmk Checkmk GmbH | 4.8 | Jun 8 | Fix stored XSS in global settings change log |
| CVE-2026-7765 | CH Checkmk Checkmk GmbH | 5.3 | Jun 8 | User Messages widget leaked issuer messages on shared dashboards |
| CVE-2026-7186 | CH Checkmk Checkmk GmbH | 5.4 | Jun 8 | Fix stored XSS in URL dashboard widget via dangerous URI schemes |
| CVE-2024-47091 | CH Checkmk Checkmk GmbH | 7.8 | May 13 | Privilege escalation via mk_mysql agent plugin on Windows |
| CVE-2026-33457 | CH Checkmk Checkmk GmbH | 6.3 | Apr 10 | Potential livestatus injection in prediction graph page |
| CVE-2026-33456 | CH Checkmk Checkmk GmbH | 7.6 | Apr 10 | Potential livestatus injection in notification test |
| CVE-2026-33455 | CH Checkmk Checkmk GmbH | 6.3 | Apr 10 | Livestatus injection in monitoring quicksearch |
| CVE-2025-39666 | CH Checkmk Checkmk GmbH | 7.3 | Apr 7 | omd: Local privilege escalation when executing omd commands as root |
| CVE-2026-3466 | CH Checkmk Checkmk GmbH | 5.4 | Apr 7 | Cross-site scripting in dashlet title |
| CVE-2026-24096 | CH Checkmk Checkmk GmbH | 8.8 | Apr 1 | Insufficient permission validation on multiple REST API Quick Setup endpoints |
| CVE-2026-20915 | CH Checkmk Checkmk GmbH | 5.4 | Mar 31 | Stored cross-site scripting in Pending Changes sidebar |
| CVE-2026-33276 | CH Checkmk Checkmk GmbH | 5.4 | Mar 31 | XSS in Unified Search via Unescaped Host/Service Names |
| CVE-2025-64998 | CH Checkmk Checkmk GmbH | 7.2 | Mar 24 | Session hijacking via exposed session signing secret in distributed Checkmk setups |
| CVE-2026-2859 | CH Checkmk Checkmk GmbH | 4.3 | Mar 13 | Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint |
| CVE-2026-24097 | CH Checkmk Checkmk GmbH | 4.3 | Mar 13 | Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint |
| CVE-2026-3103 | CH Checkmk Checkmk GmbH | 5.4 | Mar 4 | Deletion of passwords via RestApi |
| CVE-2025-64999 | CH Checkmk Checkmk GmbH | 5.4 | Feb 26 | Cross-site scripting in HTML logs of Synthetic Monitoring test services |
| CVE-2026-24095 | CH Checkmk Checkmk GmbH | 5.3 | Feb 9 | Missing Permission Check on Analyze Configuration Page |
| CVE-2025-65000 | CH Checkmk Checkmk GmbH | 5.3 | Dec 18 | Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule |
| CVE-2025-64997 | CH Checkmk Checkmk GmbH | 6.5 | Dec 18 | Insufficient permission validation when showing agent information |
| CVE-2025-58121 | CH Checkmk Checkmk GmbH | 5.4 | Nov 18 | Insufficient permission validation on multiple REST API endpoints |
| CVE-2025-58122 | CH Checkmk Checkmk GmbH | 5.4 | Nov 18 | Insufficient permission validation when configuring notification parameters |
| CVE-2025-64996 | CH Checkmk Checkmk GmbH | 4.4 | Nov 18 | Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output |
| CVE-2025-39663 | CH Checkmk Checkmk GmbH | 8.4 | Oct 30 | Cross Site Scripting through compromised remote site |
| CVE-2025-39664 | CH Checkmk Checkmk GmbH | 6.5 | Oct 9 | Path-Traversal in report scheduler |
| CVE-2025-32919 | CH Checkmk Checkmk GmbH | 7.8 | Oct 9 | Privilege Escalation in Windows License plugin for Checkmk Windows Agent |
| CVE-2025-32916 | CH Checkmk Checkmk GmbH | 4.3 | Oct 9 | Sensitive form data in URL query parameters |
| CVE-2024-38864 | CH Checkmk Checkmk GmbH | 3.3 | Dec 19 | User-Readable Private Key in Windows Agent |
| CVE-2024-6572 | CH Checkmk Checkmk GmbH | 7.4 | Sep 9 | Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' |
| CVE-2024-38858 | CH Checkmk Checkmk GmbH | 6.1 | Sep 2 | Cross-site scripting in Robotmk logs view |