Brute-force protection ineffective for some login methods

Insufficient permission validation on multiple REST API Quick Setup endpoints

Livestatus injection in autocomplete endpoint

Arbitrary file write with vcrtrace

Privilege escalation in jar_signature

Livestatus command injection in RestAPI

Fix 2FA bypass via RestAPI

1-Click compromize via CSRF

Open redirect and XSS via reset_url parameter

Cross Site Scripting through compromised remote site

Unrestricted upload and download paths in check_sftp

Privilege escalation via mk_mysql agent plugin on Windows

Privilege Escalation in Windows License plugin for Checkmk Windows Agent

Privilege escalation in mk_informix plugin

Privilege escalation in Windows agent

Privilege escalation in mk_informix plugin

Privilege escalation in windows agent

Privilege escalation in jar_signature

Privilege escalation in mk_tsm

Privilege escalation in agent via LD_LIBRARY_PATH

Potential livestatus injection in notification test

Remote site authentication secrets written to web log

LDAP credentials logged to Apache error log

CSRF token leaked in URL parameters

Information leak in mknotifyd

Missing brute-force protection for two factor authentication

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'

omd: Local privilege escalation when executing omd commands as root

Session hijacking via exposed session signing secret in distributed Checkmk setups

Trust of compromised eMudhra root CA in bundled CA stores

Agent receiver accepts mTLS requests without a client certificate

Privilege escalation in mk_oracle plugins

Insufficient permission validation when showing agent information

Path-Traversal in report scheduler

Livestatus injection in mknotifyd

Disabled automation users could still authenticate

Potential livestatus injection in prediction graph page

Livestatus injection in monitoring quicksearch

Reflected links in error message facilitate phishing attacks

Cross-site scripting in Robotmk logs view

XSS in view page with SLA column

Reflected links in visuals facilitate phishing attacks

Sensitive data exposed during automatic agent updates

Logging of sitesecret to automations log

Argument injection to runmqsc

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validatio

Fix stored XSS in URL dashboard widget via dangerous URI schemes

Cross-site scripting in dashlet title

Stored cross-site scripting in Pending Changes sidebar

XSS in Unified Search via Unescaped Host/Service Names