Checkmk Gmbh vulnerabilities
100 CVEs and advisories name Checkmk Gmbh as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111573Privilege escalation via unprotected Windows agent data folder
- CVE-2026-103682Jolokia special agent exposes password in process list
- CVE-2026-103674NetApp ONTAP special agent exposes password in process list
- CVE-2026-117611Trust of compromised eMudhra root CA in bundled CA stores
- CVE-2026-113461mk-oracle: Local privilege escalation via insecure Oracle Home library loading
- CVE-2026-14452Open redirect and XSS via reset_url parameter
- CVE-2026-105331mk-oracle: Local privilege escalation via malicious Oracle Instant Client
- CVE-2026-90990Livestatus injection via monitoring filter values
- CVE-2026-92882Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
- CVE-2026-77021Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
- CVE-2026-15937Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
- CVE-2026-17548Missing authorization for viewing background jobs
- CVE-2026-15576Agent receiver accepts mTLS requests without a client certificate
- CVE-2026-7485Frozen BI aggregations leak host and service names to unauthorized users
- CVE-2026-15227Missing Authorization Allows Editing of Foreign Reports
- CVE-2026-8593Fix Business Intelligence API Pack permission
- CVE-2026-14852mk_sap_hana: Privilege escalation via crafted sapstartsrv process name
- CVE-2026-9549Fix XSS in service discovery active check output
- CVE-2026-8833XSS in urls
- CVE-2026-8078Fix stored XSS in global settings change log
- CVE-2026-7765User Messages widget leaked issuer messages on shared dashboards
- CVE-2026-7186Fix stored XSS in URL dashboard widget via dangerous URI schemes
- CVE-2024-47091Privilege escalation via mk_mysql agent plugin on Windows
- CVE-2026-33457Potential livestatus injection in prediction graph page
- CVE-2026-33456Potential livestatus injection in notification test
- CVE-2026-33455Livestatus injection in monitoring quicksearch
- CVE-2025-39666omd: Local privilege escalation when executing omd commands as root
- CVE-2026-3466Cross-site scripting in dashlet title
- CVE-2026-24096Insufficient permission validation on multiple REST API Quick Setup endpoints
- CVE-2026-20915Stored cross-site scripting in Pending Changes sidebar