Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Checkmk — Vulnerabilities & Security Advisories 111

All 111 CVE vulnerabilities found in Checkmk, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumerations (CWE) associated with the Checkmk product developed by Checkmk GmbH. It aggregates vulnerability data specifically tied to this network monitoring and infrastructure management solution, focusing on security flaws identified within the software ecosystem. The content covers a comprehensive range of vulnerability types, including injection flaws, cross-site scripting issues, and improper access controls, spanning historical releases from early iterations through to recent updates. This timeframe ensures that users can analyze both legacy security gaps and contemporary threats affecting the platform. Here, security professionals and system administrators can effectively track vendor security advisories as they are published by Checkmk. Users can also gain a deeper understanding of specific weakness classes by examining real-world examples within the Checkmk context. Furthermore, the page facilitates the lookup of a product’s vulnerability history, allowing teams to review past incidents and assess the evolution of security postures over time. This resource serves as a centralized reference for evaluating the risk landscape surrounding Checkmk installations. By consolidating these details, it supports informed decision-making regarding patch management and configuration hardening. The aggregation avoids marketing language to provide a factual, technical overview suitable for security audits and compliance reviews. Readers are encouraged to use this information to prioritize remediation efforts based on severity and relevance to their specific deployment environments.

Vendor: Tribe29

CVE ID Title CVSS Severity Published
CVE-2026-24097 Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint CWE-204 4.3 - 2026-03-13
CVE-2026-3103 Deletion of passwords via RestApi CWE-863 7.1AI High AI 2026-03-04
CVE-2025-64999 Cross-site scripting in HTML logs of Synthetic Monitoring test services CWE-79 6.1AI Medium AI 2026-02-26
CVE-2026-24095 Missing Permission Check on Analyze Configuration Page CWE-862 4.3AI Medium AI 2026-02-09
CVE-2025-65000 Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule CWE-212 7.5AI High AI 2025-12-18
CVE-2025-64997 Insufficient permission validation when showing agent information CWE-280 6.5AI Medium AI 2025-12-18
CVE-2025-58121 Insufficient permission validation on multiple REST API endpoints CWE-280 8.8AI High AI 2025-11-18
CVE-2025-58122 Insufficient permission validation when configuring notification parameters CWE-280 8.1AI High AI 2025-11-18
CVE-2025-64996 Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output CWE-732 7.1AI High AI 2025-11-18
CVE-2025-39663 Cross Site Scripting through compromised remote site CWE-80 6.1AI Medium AI 2025-10-30
CVE-2025-39664 Path-Traversal in report scheduler CWE-22 4.3AI Medium AI 2025-10-09
CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent CWE-427 7.8AI High AI 2025-10-09
CVE-2025-32916 Sensitive form data in URL query parameters CWE-598 5.3AI Medium AI 2025-10-09
CVE-2025-32918 Livestatus injection in autocomplete endpoint CWE-140 8.8 - 2025-07-04
CVE-2025-32915 Sensitive data exposed during automatic agent updates CWE-732 5.5AI Medium AI 2025-05-22
CVE-2025-1712 Arbitrary file write with vcrtrace CWE-88 6.5AI Medium AI 2025-05-21
CVE-2025-32917 Privilege escalation in jar_signature CWE-427 7.8AI High AI 2025-05-13
CVE-2025-3506 Potentially senitive path exposed via unauthenticated http route CWE-497 7.5AI High AI 2025-05-08
CVE-2025-2092 Remote site authentication secrets written to web log CWE-532 7.5 - 2025-04-22
CVE-2024-38865 Livestatus command injection in RestAPI CWE-140 8.8AI High AI 2025-04-10
CVE-2025-2596 Session logout can be overwritten by long lasting request CWE-613 7.1AI High AI 2025-03-26
CVE-2025-1075 LDAP credentials logged to Apache error log CWE-532 4.9 - 2025-02-19
CVE-2024-38864 User-Readable Private Key in Windows Agent CWE-732 5.5 - 2024-12-19
CVE-2024-47094 Logging of sitesecret to automations log CWE-532 7.5 - 2024-11-29
CVE-2024-38863 CSRF token leaked in URL parameters CWE-598 6.5AI Medium AI 2024-10-14
CVE-2024-38862 SNMP and IMPI secrets written to audit log CWE-532 4.9AI Medium AI 2024-10-14
CVE-2024-6747 Information leak in mknotifyd CWE-201 5.3 Medium 2024-10-10
CVE-2024-8606 Fix 2FA bypass via RestAPI CWE-863 6.5AI Medium AI 2024-09-23
CVE-2024-38860 Reflected links in error message facilitate phishing attacks CWE-79 6.1 - 2024-09-17
CVE-2024-6572 Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' CWE-322 5.9AI Medium AI 2024-09-09

All 111 known CVE vulnerabilities affecting Checkmk with full Chinese analysis, references, and POCs where available.