Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Checkmk — Vulnerabilities & Security Advisories 111

All 111 CVE vulnerabilities found in Checkmk, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumerations (CWE) associated with the Checkmk product developed by Checkmk GmbH. It aggregates vulnerability data specifically tied to this network monitoring and infrastructure management solution, focusing on security flaws identified within the software ecosystem. The content covers a comprehensive range of vulnerability types, including injection flaws, cross-site scripting issues, and improper access controls, spanning historical releases from early iterations through to recent updates. This timeframe ensures that users can analyze both legacy security gaps and contemporary threats affecting the platform. Here, security professionals and system administrators can effectively track vendor security advisories as they are published by Checkmk. Users can also gain a deeper understanding of specific weakness classes by examining real-world examples within the Checkmk context. Furthermore, the page facilitates the lookup of a product’s vulnerability history, allowing teams to review past incidents and assess the evolution of security postures over time. This resource serves as a centralized reference for evaluating the risk landscape surrounding Checkmk installations. By consolidating these details, it supports informed decision-making regarding patch management and configuration hardening. The aggregation avoids marketing language to provide a factual, technical overview suitable for security audits and compliance reviews. Readers are encouraged to use this information to prioritize remediation efforts based on severity and relevance to their specific deployment environments.

Vendor: Tribe29

CVE ID Title CVSS Severity Published
CVE-2026-117611 Trust of compromised eMudhra root CA in bundled CA stores CWE-295 7.1 High 2026-10-29
CVE-2026-113461 mk-oracle: Local privilege escalation via insecure Oracle Home library loading CWE-426 5.2 Medium 2026-10-21
CVE-2026-14452 Open redirect and XSS via reset_url parameter CWE-601 8.6 High 2026-10-16
CVE-2026-105331 mk-oracle: Local privilege escalation via malicious Oracle Instant Client CWE-426 5.2 Medium 2026-10-08
CVE-2026-90990 Livestatus injection via monitoring filter values CWE-93 5.3 Medium 2026-09-22
CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses CWE-522 2.3 Low 2026-09-22
CVE-2026-77021 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data CWE-409 5.3 Medium 2026-09-21
CVE-2026-15937 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint CWE-295 5.3 Medium 2026-09-04
CVE-2026-17548 Missing authorization for viewing background jobs CWE-862 5.3 Medium 2026-08-25
CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate CWE-306 6.9 Medium 2026-08-21
CVE-2026-7485 Frozen BI aggregations leak host and service names to unauthorized users CWE-863 2.3 Low 2026-08-20
CVE-2026-15227 Missing Authorization Allows Editing of Foreign Reports CWE-862 5.3 Medium 2026-07-31
CVE-2026-8593 Fix Business Intelligence API Pack permission CWE-862 - - 2026-07-21
CVE-2026-14852 mk_sap_hana: Privilege escalation via crafted sapstartsrv process name CWE-78 5.2 Medium 2026-07-14
CVE-2026-9549 Fix XSS in service discovery active check output CWE-79 - - 2026-06-08
CVE-2026-8833 XSS in urls CWE-79 - - 2026-06-08
CVE-2026-8078 Fix stored XSS in global settings change log CWE-79 - - 2026-06-08
CVE-2026-7765 User Messages widget leaked issuer messages on shared dashboards CWE-863 - - 2026-06-08
CVE-2026-7186 Fix stored XSS in URL dashboard widget via dangerous URI schemes CWE-79 - - 2026-06-08
CVE-2024-47091 Privilege escalation via mk_mysql agent plugin on Windows CWE-427 - - 2026-05-13
CVE-2026-33457 Potential livestatus injection in prediction graph page CWE-140 8.8 - 2026-04-10
CVE-2026-33456 Potential livestatus injection in notification test CWE-140 8.8 - 2026-04-10
CVE-2026-33455 Livestatus injection in monitoring quicksearch CWE-140 8.8 - 2026-04-10
CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root CWE-426 7.8AI High AI 2026-04-07
CVE-2026-3466 Cross-site scripting in dashlet title CWE-79 5.4AI Medium AI 2026-04-07
CVE-2026-24096 Insufficient permission validation on multiple REST API Quick Setup endpoints CWE-280 8.8AI High AI 2026-04-01
CVE-2026-20915 Stored cross-site scripting in Pending Changes sidebar CWE-79 5.4AI Medium AI 2026-03-31
CVE-2026-33276 XSS in Unified Search via Unescaped Host/Service Names CWE-79 5.4AI Medium AI 2026-03-31
CVE-2025-64998 Session hijacking via exposed session signing secret in distributed Checkmk setups CWE-522 6.5 - 2026-03-24
CVE-2026-2859 Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint CWE-204 5.3 - 2026-03-13

All 111 known CVE vulnerabilities affecting Checkmk with full Chinese analysis, references, and POCs where available.