# Checkmk. Every CVE that names Checkmk among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Trust of compromised eMudhra root CA in bundled CA stores](https://agentprime.io/advisories/CVE-2026-117611.md) `CVE-2026-117611` · CVE record: Checkmk GmbH Checkmk · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1395 - [mk-oracle: Local privilege escalation via insecure Oracle Home library loading](https://agentprime.io/advisories/CVE-2026-113461.md) `CVE-2026-113461` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-426, CWE-829 - [Open redirect and XSS via reset_url parameter](https://agentprime.io/advisories/CVE-2026-14452.md) `CVE-2026-14452` · CVE record: Checkmk GmbH Checkmk · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Open redirect - [mk-oracle: Local privilege escalation via malicious Oracle Instant Client](https://agentprime.io/advisories/CVE-2026-105331.md) `CVE-2026-105331` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-426, CWE-829 - [Livestatus injection via monitoring filter values](https://agentprime.io/advisories/CVE-2026-90990.md) `CVE-2026-90990` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection - [Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses](https://agentprime.io/advisories/CVE-2026-92882.md) `CVE-2026-92882` · CVE record: Checkmk GmbH Checkmk · CVSS 2.3 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials - [Missing decompression size limit in agent receiver allows memory exhaustion via push agent data](https://agentprime.io/advisories/CVE-2026-77021.md) `CVE-2026-77021` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-409 - [Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint](https://agentprime.io/advisories/CVE-2026-15937.md) `CVE-2026-15937` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Weak cryptography or TLS - [Missing authorization for viewing background jobs](https://agentprime.io/advisories/CVE-2026-17548.md) `CVE-2026-17548` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control - [Agent receiver accepts mTLS requests without a client certificate](https://agentprime.io/advisories/CVE-2026-15576.md) `CVE-2026-15576` · CVE record: Checkmk GmbH Checkmk · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass - [Frozen BI aggregations leak host and service names to unauthorized users](https://agentprime.io/advisories/CVE-2026-7485.md) `CVE-2026-7485` · CVE record: Checkmk GmbH Checkmk · CVSS 2.3 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control - [Missing Authorization Allows Editing of Foreign Reports](https://agentprime.io/advisories/CVE-2026-15227.md) `CVE-2026-15227` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Fix Business Intelligence API Pack permission](https://agentprime.io/advisories/CVE-2026-8593.md) `CVE-2026-8593` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [mk_sap_hana: Privilege escalation via crafted sapstartsrv process name](https://agentprime.io/advisories/CVE-2026-14852.md) `CVE-2026-14852` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Command injection - [Fix XSS in service discovery active check output](https://agentprime.io/advisories/CVE-2026-9549.md) `CVE-2026-9549` · CVE record: Checkmk GmbH Checkmk · CVSS 4.8 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Cross-site scripting (XSS) - [XSS in urls](https://agentprime.io/advisories/CVE-2026-8833.md) `CVE-2026-8833` · CVE record: Checkmk GmbH Checkmk · CVSS 8.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Cross-site scripting (XSS) - [Fix stored XSS in global settings change log](https://agentprime.io/advisories/CVE-2026-8078.md) `CVE-2026-8078` · CVE record: Checkmk GmbH Checkmk · CVSS 4.8 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Cross-site scripting (XSS) - [User Messages widget leaked issuer messages on shared dashboards](https://agentprime.io/advisories/CVE-2026-7765.md) `CVE-2026-7765` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Broken access control - [Fix stored XSS in URL dashboard widget via dangerous URI schemes](https://agentprime.io/advisories/CVE-2026-7186.md) `CVE-2026-7186` · CVE record: Checkmk GmbH Checkmk · CVSS 8.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Cross-site scripting (XSS) - [Privilege escalation via mk_mysql agent plugin on Windows](https://agentprime.io/advisories/CVE-2024-47091.md) `CVE-2024-47091` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-427 - [Potential livestatus injection in prediction graph page](https://agentprime.io/advisories/CVE-2026-33457.md) `CVE-2026-33457` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-140 - [Potential livestatus injection in notification test](https://agentprime.io/advisories/CVE-2026-33456.md) `CVE-2026-33456` · CVE record: Checkmk GmbH Checkmk · CVSS 5.1 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-140 - [Livestatus injection in monitoring quicksearch](https://agentprime.io/advisories/CVE-2026-33455.md) `CVE-2026-33455` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-140 - [omd: Local privilege escalation when executing omd commands as root](https://agentprime.io/advisories/CVE-2025-39666.md) `CVE-2025-39666` · CVE record: Checkmk GmbH Checkmk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-426, CWE-829 - [Cross-site scripting in dashlet title](https://agentprime.io/advisories/CVE-2026-3466.md) `CVE-2026-3466` · CVE record: Checkmk GmbH Checkmk · CVSS 8.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS) - [Insufficient permission validation on multiple REST API Quick Setup endpoints](https://agentprime.io/advisories/CVE-2026-24096.md) `CVE-2026-24096` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-280 - [Stored cross-site scripting in Pending Changes sidebar](https://agentprime.io/advisories/CVE-2026-20915.md) `CVE-2026-20915` · CVE record: Checkmk GmbH Checkmk · CVSS 8.5 High · Not analysed yet · Published 31 Mar 2026 · Tags: Cross-site scripting (XSS) - [XSS in Unified Search via Unescaped Host/Service Names](https://agentprime.io/advisories/CVE-2026-33276.md) `CVE-2026-33276` · CVE record: Checkmk GmbH Checkmk · CVSS 8.6 High · Not analysed yet · Published 31 Mar 2026 · Tags: Cross-site scripting (XSS) - [Session hijacking via exposed session signing secret in distributed Checkmk setups](https://agentprime.io/advisories/CVE-2025-64998.md) `CVE-2025-64998` · CVE record: Checkmk GmbH Checkmk · CVSS 7.3 High · Not analysed yet · Published 24 Mar 2026 · Tags: Hard-coded credentials - [Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint](https://agentprime.io/advisories/CVE-2026-2859.md) `CVE-2026-2859` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint](https://agentprime.io/advisories/CVE-2026-24097.md) `CVE-2026-24097` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [Deletion of passwords via RestApi](https://agentprime.io/advisories/CVE-2026-3103.md) `CVE-2026-3103` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: Broken access control - [Cross-site scripting in HTML logs of Synthetic Monitoring test services](https://agentprime.io/advisories/CVE-2025-64999.md) `CVE-2025-64999` · CVE record: Checkmk GmbH Checkmk · CVSS 7.3 High · Not analysed yet · Published 26 Feb 2026 · Tags: Cross-site scripting (XSS) - [Missing Permission Check on Analyze Configuration Page](https://agentprime.io/advisories/CVE-2026-24095.md) `CVE-2026-24095` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Broken access control - [Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule](https://agentprime.io/advisories/CVE-2025-65000.md) `CVE-2025-65000` · CVE record: Checkmk GmbH Checkmk · CVSS 2.3 Low · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-212 - [Insufficient permission validation when showing agent information](https://agentprime.io/advisories/CVE-2025-64997.md) `CVE-2025-64997` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-280 - [Insufficient permission validation on multiple REST API endpoints](https://agentprime.io/advisories/CVE-2025-58121.md) `CVE-2025-58121` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-280 - [Insufficient permission validation when configuring notification parameters](https://agentprime.io/advisories/CVE-2025-58122.md) `CVE-2025-58122` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-280 - [Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output](https://agentprime.io/advisories/CVE-2025-64996.md) `CVE-2025-64996` · CVE record: Checkmk GmbH Checkmk · CVSS 4.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Broken access control - [Cross Site Scripting through compromised remote site](https://agentprime.io/advisories/CVE-2025-39663.md) `CVE-2025-39663` · CVE record: Checkmk GmbH Checkmk · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS) - [Path-Traversal in report scheduler](https://agentprime.io/advisories/CVE-2025-39664.md) `CVE-2025-39664` · CVE record: Checkmk GmbH Checkmk · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2025 · Tags: Path traversal - [Privilege Escalation in Windows License plugin for Checkmk Windows Agent](https://agentprime.io/advisories/CVE-2025-32919.md) `CVE-2025-32919` · CVE record: Checkmk GmbH Checkmk · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-427 - [Sensitive form data in URL query parameters](https://agentprime.io/advisories/CVE-2025-32916.md) `CVE-2025-32916` · CVE record: Checkmk GmbH Checkmk · CVSS 1.0 Low · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-598 - [Livestatus injection in autocomplete endpoint](https://agentprime.io/advisories/CVE-2025-32918.md) `CVE-2025-32918` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: CWE-140 - [Sensitive data exposed during automatic agent updates](https://agentprime.io/advisories/CVE-2025-32915.md) `CVE-2025-32915` · CVE record: Checkmk GmbH Checkmk · CVSS 4.3 Medium · Not analysed yet · Published 22 May 2025 · Tags: Broken access control - [Arbitrary file write with vcrtrace](https://agentprime.io/advisories/CVE-2025-1712.md) `CVE-2025-1712` · CVE record: Checkmk GmbH Checkmk · CVSS 8.7 High · Not analysed yet · Published 21 May 2025 · Tags: Command injection - [Privilege escalation in jar_signature](https://agentprime.io/advisories/CVE-2025-32917.md) `CVE-2025-32917` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-427 - [Potentially senitive path exposed via unauthenticated http route](https://agentprime.io/advisories/CVE-2025-3506.md) `CVE-2025-3506` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 8 May 2025 · Tags: Information disclosure - [Remote site authentication secrets written to web log](https://agentprime.io/advisories/CVE-2025-2092.md) `CVE-2025-2092` · CVE record: Checkmk GmbH Checkmk · CVSS 7.1 High · Not analysed yet · Published 22 Apr 2025 · Tags: Information disclosure - [Livestatus command injection in RestAPI](https://agentprime.io/advisories/CVE-2024-38865.md) `CVE-2024-38865` · CVE record: Checkmk GmbH Checkmk · CVSS 6.0 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-140 - [Session logout can be overwritten by long lasting request](https://agentprime.io/advisories/CVE-2025-2596.md) `CVE-2025-2596` · CVE record: Checkmk GmbH Checkmk · CVSS 2.3 Low · Not analysed yet · Published 26 Mar 2025 · Tags: Authentication bypass - [LDAP credentials logged to Apache error log](https://agentprime.io/advisories/CVE-2025-1075.md) `CVE-2025-1075` · CVE record: Checkmk GmbH Checkmk · CVSS 5.6 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Information disclosure - [User-Readable Private Key in Windows Agent](https://agentprime.io/advisories/CVE-2024-38864.md) `CVE-2024-38864` · CVE record: Checkmk GmbH Checkmk · CVSS 4.8 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Broken access control - [Logging of sitesecret to automations log](https://agentprime.io/advisories/CVE-2024-47094.md) `CVE-2024-47094` · CVE record: Checkmk GmbH Checkmk · CVSS 5.7 Medium · Not analysed yet · Published 29 Nov 2024 · Tags: Information disclosure - [CSRF token leaked in URL parameters](https://agentprime.io/advisories/CVE-2024-38863.md) `CVE-2024-38863` · CVE record: Checkmk GmbH Checkmk · CVSS 2.0 Low · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-598 - [SNMP and IMPI secrets written to audit log](https://agentprime.io/advisories/CVE-2024-38862.md) `CVE-2024-38862` · CVE record: Checkmk GmbH Checkmk · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Information disclosure - [Information leak in mknotifyd](https://agentprime.io/advisories/CVE-2024-6747.md) `CVE-2024-6747` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2024 · Tags: Information disclosure - [Fix 2FA bypass via RestAPI](https://agentprime.io/advisories/CVE-2024-8606.md) `CVE-2024-8606` · CVE record: Checkmk GmbH Checkmk · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2024 · Tags: Broken access control - [Reflected links in error message facilitate phishing attacks](https://agentprime.io/advisories/CVE-2024-38860.md) `CVE-2024-38860` · CVE record: Checkmk GmbH Checkmk · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: Cross-site scripting (XSS) - [Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'](https://agentprime.io/advisories/CVE-2024-6572.md) `CVE-2024-6572` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 9 Sept 2024 · Tags: CWE-322 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .