Checkmk vulnerabilities

Products

• Checkmk 108
• Nagvis 2

Newest

• checkmk Fix XSS in service discovery active check output CVE-2026-9549 4.8 MediumJune 8, 2026
• checkmk XSS in urls CVE-2026-8833 8.5 HighJune 8, 2026
• checkmk Fix stored XSS in global settings change log CVE-2026-8078 4.8 MediumJune 8, 2026
• checkmk User Messages widget leaked issuer messages on shared dashboards CVE-2026-7765 6.3 MediumJune 8, 2026
• checkmk Fix stored XSS in URL dashboard widget via dangerous URI schemes CVE-2026-7186 8.5 HighJune 8, 2026
• checkmk Privilege escalation via mk_mysql agent plugin on Windows CVE-2024-47091 5.2 MediumMay 13, 2026
• checkmk Potential livestatus injection in prediction graph page CVE-2026-33457 5.3 MediumApril 10, 2026
• checkmk Potential livestatus injection in notification test CVE-2026-33456 5.1 MediumApril 10, 2026
• checkmk Livestatus injection in monitoring quicksearch CVE-2026-33455 5.3 MediumApril 10, 2026
• checkmk omd: Local privilege escalation when executing omd commands as root CVE-2025-39666 9.3 CriticalApril 7, 2026
• checkmk Cross-site scripting in dashlet title CVE-2026-3466 8.5 HighApril 7, 2026
• checkmk Insufficient permission validation on multiple REST API Quick Setup endpoints CVE-2026-24096 5.3 MediumApril 1, 2026
• checkmk Stored cross-site scripting in Pending Changes sidebar CVE-2026-20915 8.5 HighMarch 31, 2026
• checkmk XSS in Unified Search via Unescaped Host/Service Names CVE-2026-33276 8.6 HighMarch 31, 2026
• checkmk Session hijacking via exposed session signing secret in distributed Checkmk setups CVE-2025-64998 7.3 HighMarch 24, 2026
• checkmk Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint CVE-2026-2859 6.3 MediumMarch 13, 2026
• checkmk Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint CVE-2026-24097 5.3 MediumMarch 13, 2026
• checkmk Deletion of passwords via RestApi CVE-2026-3103 5.3 MediumMarch 4, 2026
• checkmk Cross-site scripting in HTML logs of Synthetic Monitoring test services CVE-2025-64999 7.3 HighFebruary 26, 2026
• checkmk Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule CVE-2025-65000 2.3 LowDecember 18, 2025
• checkmk Insufficient permission validation when showing agent information CVE-2025-64997 6.3 MediumDecember 18, 2025
• checkmk Insufficient permission validation on multiple REST API endpoints CVE-2025-58121 5.3 MediumNovember 18, 2025
• checkmk Insufficient permission validation when configuring notification parameters CVE-2025-58122 5.3 MediumNovember 18, 2025
• checkmk Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output CVE-2025-64996 4.8 MediumNovember 18, 2025
• checkmk Cross Site Scripting through compromised remote site CVE-2025-39663 8.5 HighOctober 30, 2025
• checkmk Path-Traversal in report scheduler CVE-2025-39664 7.1 HighOctober 9, 2025
• checkmk Privilege Escalation in Windows License plugin for Checkmk Windows Agent CVE-2025-32919 8.8 HighOctober 9, 2025
• checkmk Sensitive form data in URL query parameters CVE-2025-32916 1.0 LowOctober 9, 2025
• checkmk Livestatus injection in autocomplete endpoint CVE-2025-32918 5.3 MediumJuly 4, 2025
• checkmk Sensitive data exposed during automatic agent updates CVE-2025-32915 4.3 MediumMay 22, 2025
• checkmk Arbitrary file write with vcrtrace CVE-2025-1712 8.7 HighMay 21, 2025
• checkmk Privilege escalation in jar_signature CVE-2025-32917 5.2 MediumMay 13, 2025
• checkmk Potentially senitive path exposed via unauthenticated http route CVE-2025-3506 6.3 MediumMay 8, 2025
• checkmk Remote site authentication secrets written to web log CVE-2025-2092 7.1 HighApril 22, 2025
• checkmk Livestatus command injection in RestAPI CVE-2024-38865 6.0 MediumApril 10, 2025
• checkmk Session logout can be overwritten by long lasting request CVE-2025-2596 2.3 LowMarch 26, 2025
• checkmk LDAP credentials logged to Apache error log CVE-2025-1075 5.6 MediumFebruary 19, 2025
• checkmk nagvis Checkmk NagVis Reflected Cross-site Scripting CVE-2024-13722 Fix available 5.4 MediumFebruary 4, 2025
• checkmk nagvis Checkmk NagVis Remote Code Execution CVE-2024-13723 Fix available 7.2 HighFebruary 4, 2025
• checkmk User-Readable Private Key in Windows Agent CVE-2024-38864 4.8 MediumDecember 19, 2024
• checkmk Logging of sitesecret to automations log CVE-2024-47094 5.7 MediumNovember 29, 2024
• checkmk CSRF token leaked in URL parameters CVE-2024-38863 2.0 LowOctober 14, 2024
• checkmk SNMP and IMPI secrets written to audit log CVE-2024-38862 5.1 MediumOctober 14, 2024
• checkmk Information leak in mknotifyd CVE-2024-6747 5.3 MediumOctober 10, 2024
• checkmk Fix 2FA bypass via RestAPI CVE-2024-8606 9.2 CriticalSeptember 23, 2024
• checkmk Reflected links in error message facilitate phishing attacks CVE-2024-38860 5.1 MediumSeptember 17, 2024
• checkmk Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' CVE-2024-6572 6.3 MediumSeptember 9, 2024
• checkmk Cross-site scripting in Robotmk logs view CVE-2024-38858 2.3 LowSeptember 2, 2024
• checkmk XSS in view page with SLA column CVE-2024-38859 4.8 MediumAugust 26, 2024
• checkmk Privilege escalation in mk_informix plugin CVE-2024-28829 5.2 MediumAugust 20, 2024
• Show olderLoading…