Insufficient permission validation on multiple REST API Quick Setup endpoints

Livestatus injection in autocomplete endpoint

Arbitrary file write with vcrtrace

Privilege escalation in jar_signature

Livestatus command injection in RestAPI

Fix 2FA bypass via RestAPI

1-Click compromize via CSRF

Open redirect and XSS via reset_url parameter

Cross Site Scripting through compromised remote site

Unrestricted upload and download paths in check_sftp

Privilege escalation via mk_mysql agent plugin on Windows

Privilege Escalation in Windows License plugin for Checkmk Windows Agent

Privilege escalation in mk_informix plugin

Privilege escalation in Windows agent

Potential livestatus injection in notification test

Remote site authentication secrets written to web log

LDAP credentials logged to Apache error log

CSRF token leaked in URL parameters

Information leak in mknotifyd

Missing brute-force protection for two factor authentication

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'

omd: Local privilege escalation when executing omd commands as root

Session hijacking via exposed session signing secret in distributed Checkmk setups

Trust of compromised eMudhra root CA in bundled CA stores

Agent receiver accepts mTLS requests without a client certificate

Insufficient permission validation when showing agent information

Path-Traversal in report scheduler

Livestatus injection in mknotifyd

Potential livestatus injection in prediction graph page

Livestatus injection in monitoring quicksearch

Reflected links in error message facilitate phishing attacks

Cross-site scripting in Robotmk logs view

XSS in view page with SLA column

Reflected links in visuals facilitate phishing attacks

Sensitive data exposed during automatic agent updates

Logging of sitesecret to automations log

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validatio

Fix stored XSS in URL dashboard widget via dangerous URI schemes

Cross-site scripting in dashlet title

Stored cross-site scripting in Pending Changes sidebar

XSS in Unified Search via Unescaped Host/Service Names

Deletion of passwords via RestApi

Cross-site scripting in HTML logs of Synthetic Monitoring test services

Insufficient permission validation on multiple REST API endpoints

Insufficient permission validation when configuring notification parameters

XSS in SQL check parameters

XSS in confirmation pop-up

XSS in inventory view

Livestatus injection via monitoring filter values

Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses