Checkmk Gmbh vulnerabilities
100 CVEs and advisories name Checkmk Gmbh as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33276XSS in Unified Search via Unescaped Host/Service Names
- CVE-2025-64998Session hijacking via exposed session signing secret in distributed Checkmk setups
- CVE-2026-2859Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
- CVE-2026-24097Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint
- CVE-2026-3103Deletion of passwords via RestApi
- CVE-2025-64999Cross-site scripting in HTML logs of Synthetic Monitoring test services
- CVE-2026-24095Missing Permission Check on Analyze Configuration Page
- CVE-2025-65000Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule
- CVE-2025-64997Insufficient permission validation when showing agent information
- CVE-2025-58121Insufficient permission validation on multiple REST API endpoints
- CVE-2025-58122Insufficient permission validation when configuring notification parameters
- CVE-2025-64996Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output
- CVE-2025-39663Cross Site Scripting through compromised remote site
- CVE-2025-39664Path-Traversal in report scheduler
- CVE-2025-32919Privilege Escalation in Windows License plugin for Checkmk Windows Agent
- CVE-2025-32916Sensitive form data in URL query parameters
- CVE-2025-32918Livestatus injection in autocomplete endpoint
- CVE-2025-32915Sensitive data exposed during automatic agent updates
- CVE-2025-1712Arbitrary file write with vcrtrace
- CVE-2025-32917Privilege escalation in jar_signature
- CVE-2025-3506Potentially senitive path exposed via unauthenticated http route
- CVE-2025-2092Remote site authentication secrets written to web log
- CVE-2024-38865Livestatus command injection in RestAPI
- CVE-2025-2596Session logout can be overwritten by long lasting request
- CVE-2025-1075LDAP credentials logged to Apache error log
- CVE-2024-13722Checkmk NagVis Reflected Cross-site Scripting
- CVE-2024-13723Checkmk NagVis Remote Code Execution
- CVE-2024-38864User-Readable Private Key in Windows Agent
- CVE-2024-47094Logging of sitesecret to automations log
- CVE-2024-38863CSRF token leaked in URL parameters