Skip to contentCheckmk Gmbh Checkmk vulnerabilities
- checkmk gmbh checkmkPath traversal in host label synchronization allows code execution on the central site from a remote siteCVE-2026-1189659.4 Critical
- checkmk gmbh checkmkArbitrary file write and code execution via crafted Synthetic Monitoring agent dataCVE-2026-1204959.4 Critical
- checkmk gmbh checkmkArbitrary file write and code execution via excluded node roles in Kubernetes special agentCVE-2026-1213749.4 Critical
- checkmk gmbh checkmkPrivilege escalation via unprotected Windows agent data folderCVE-2026-1115736.3 Medium
- checkmk gmbh checkmkJolokia special agent exposes password in process listCVE-2026-1036822.0 Low
- checkmk gmbh checkmkNetApp ONTAP special agent exposes password in process listCVE-2026-1036742.0 Low
- checkmk gmbh checkmkTrust of compromised eMudhra root CA in bundled CA storesCVE-2026-1176117.1 High
- checkmk gmbh checkmkmk-oracle: Local privilege escalation via insecure Oracle Home library loadingCVE-2026-1134615.2 Medium
- checkmk gmbh checkmkOpen redirect and XSS via reset_url parameterCVE-2026-144528.6 High
- checkmk gmbh checkmkmk-oracle: Local privilege escalation via malicious Oracle Instant ClientCVE-2026-1053315.2 Medium
- checkmk gmbh checkmkLivestatus injection via monitoring filter valuesCVE-2026-909905.3 Medium
- checkmk gmbh checkmkRedact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesCVE-2026-928822.3 Low
- checkmk gmbh checkmkMissing decompression size limit in agent receiver allows memory exhaustion via push agent dataCVE-2026-770215.3 Medium
- checkmk gmbh checkmkAgent receiver certificate confusion allows authentication with a certificate issued for another endpointCVE-2026-159375.3 Medium
- checkmk gmbh checkmkMissing authorization for viewing background jobsCVE-2026-175485.3 Medium
- checkmk gmbh checkmkAgent receiver accepts mTLS requests without a client certificateCVE-2026-155766.9 Medium
- checkmk gmbh checkmkFrozen BI aggregations leak host and service names to unauthorized usersCVE-2026-74852.3 Low
- checkmk gmbh checkmkMissing Authorization Allows Editing of Foreign ReportsCVE-2026-152275.3 Medium
- checkmk gmbh checkmkFix Business Intelligence API Pack permissionCVE-2026-85935.3 Medium
- checkmk gmbh checkmkmk_sap_hana: Privilege escalation via crafted sapstartsrv process nameCVE-2026-148525.2 Medium
- checkmkFix XSS in service discovery active check outputCVE-2026-95494.8 Medium
- checkmkXSS in urlsCVE-2026-88338.5 High
- checkmkFix stored XSS in global settings change logCVE-2026-80784.8 Medium
- checkmkUser Messages widget leaked issuer messages on shared dashboardsCVE-2026-77656.3 Medium
- checkmkFix stored XSS in URL dashboard widget via dangerous URI schemesCVE-2026-71868.5 High
- checkmkPrivilege escalation via mk_mysql agent plugin on WindowsCVE-2024-470915.2 Medium
- checkmkPotential livestatus injection in prediction graph pageCVE-2026-334575.3 Medium
- checkmkPotential livestatus injection in notification testCVE-2026-334565.1 Medium
- checkmkLivestatus injection in monitoring quicksearchCVE-2026-334555.3 Medium
- checkmkomd: Local privilege escalation when executing omd commands as rootCVE-2025-396669.3 Critical
- checkmkCross-site scripting in dashlet titleCVE-2026-34668.5 High
- checkmkInsufficient permission validation on multiple REST API Quick Setup endpointsCVE-2026-240965.3 Medium
- checkmkStored cross-site scripting in Pending Changes sidebarCVE-2026-209158.5 High
- checkmkXSS in Unified Search via Unescaped Host/Service NamesCVE-2026-332768.6 High
- checkmkSession hijacking via exposed session signing secret in distributed Checkmk setupsCVE-2025-649987.3 High
- checkmkUnauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent EndpointCVE-2026-28596.3 Medium
- checkmkAuthenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing EndpointCVE-2026-240975.3 Medium
- checkmkDeletion of passwords via RestApiCVE-2026-31035.3 Medium
- checkmkCross-site scripting in HTML logs of Synthetic Monitoring test servicesCVE-2025-649997.3 High
- checkmk gmbh checkmkMissing Permission Check on Analyze Configuration PageCVE-2026-240955.3 Medium
- checkmkExposure of SSH Private Keys in Remote Alert Handlers (Linux) RuleCVE-2025-650002.3 Low
- checkmkInsufficient permission validation when showing agent informationCVE-2025-649976.3 Medium
- checkmkInsufficient permission validation on multiple REST API endpointsCVE-2025-581215.3 Medium
- checkmkInsufficient permission validation when configuring notification parametersCVE-2025-581225.3 Medium
- checkmkOverly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's outputCVE-2025-649964.8 Medium
- checkmkCross Site Scripting through compromised remote siteCVE-2025-396638.5 High
- checkmkPath-Traversal in report schedulerCVE-2025-396647.1 High
- checkmkPrivilege Escalation in Windows License plugin for Checkmk Windows AgentCVE-2025-329198.8 High
- checkmkSensitive form data in URL query parametersCVE-2025-329161.0 Low
- checkmkLivestatus injection in autocomplete endpointCVE-2025-329185.3 Medium
- Show olderLoading…