CH
Product
Checkmk
75
CVEs
0
On KEV
8.8
Max CVSS
4
New 30D
Severity mix
Critical 0High 24Medium 47Low 4
Watch
Add Checkmk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-77021 | 5.3 | Sep 21 | Missing decompression size limit in agent receiver allows memory exhaustion via push agent data Affected: 2.5.0 before 2.5.0p14; 2.4.0 before 2.4.0p37; 2.3.0 before 2.3.0p51; 2.2.0 |
| CVE-2026-15937 | 5.3 | Sep 4 | Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint Affected: 2.5.0 before 2.5.0p10 |
| CVE-2026-17548 | 5.3 | Aug 25 | Missing authorization for viewing background jobs Affected: 2.5.0 before 2.5.0p12; 2.4.0 before 2.4.0p36; 2.3.0 before 2.3.0p50; 2.2.0 |
| CVE-2026-15227 | 5.3 | Jul 31 | Missing Authorization Allows Editing of Foreign Reports Affected: 2.5.0 before 2.5.0p10; 2.4.0 before 2.4.0p35; 2.3.0 before 2.3.0p49; 2.2.0 |
| CVE-2026-8593 | 5.3 | Jul 21 | Fix Business Intelligence API Pack permission Affected: 2.5.0 before 2.5.0p9; 2.4.0 before 2.4.0p34; 2.3.0 before 2.3.0p49 |
| CVE-2026-7765 | 5.3 | Jun 8 | User Messages widget leaked issuer messages on shared dashboards Affected: 2.5.0 before 2.5.0p5 |
| CVE-2026-24095 | 5.3 | Feb 9 | Missing Permission Check on Analyze Configuration Page Affected: 2.4.0 before 2.4.0p21; 2.3.0 before 2.3.0p43; 2.2.0 |
| CVE-2025-65000 | 5.3 | Dec 18 | Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule Affected: 2.4.0 before 2.4.0p18; 2.3.0 |
| CVE-2025-3506 | 5.3 | May 8 | Potentially senitive path exposed via unauthenticated http route Affected: 2.4.0 before 2.4.0b6; 2.3.0; 2.2.0; 2.1.0 through 2.1.0p50 |
| CVE-2025-2596 | 5.3 | Mar 26 | Session logout can be overwritten by long lasting request Affected: 2.4.0 before 2.4.0b2; 2.3.0 before 2.3.0p30; 2.2.0 before 2.2.0p41; 2.1.0 through 2.1.0p50 |
| CVE-2024-6163 | 5.3 | Jul 8 | local IP restriction of internal HTTP endpoints Affected: 2.3.0 before 2.3.0p10; 2.2.0 before 2.2.0p31; 2.1.0 before 2.1.0p46; 2.0.0 through 2.0.0p39 |
| CVE-2026-113461 | 5.2 | Oct 21 | mk-oracle: Local privilege escalation via insecure Oracle Home library loading Affected: 2.5.0p14 |
| CVE-2026-105331 | 5.2 | Oct 8 | mk-oracle: Local privilege escalation via malicious Oracle Instant Client Affected: 2.5.0 before 2.5.0p10 |
| CVE-2026-14852 | 5.2 | Jul 14 | mk_sap_hana: Privilege escalation via crafted sapstartsrv process name Affected: 2.5.0 before 2.5.0p9; 2.4.0 before 2.4.0p34; 2.3.0 before 2.3.0p49; 2.2.0 |
| CVE-2026-9549 | 4.8 | Jun 8 | Fix XSS in service discovery active check output Affected: 2.5.0 before 2.5.0p5; 2.4.0 before 2.4.0p31; 2.3.0 before 2.3.0p48; 2.2.0 |
| CVE-2026-8078 | 4.8 | Jun 8 | Fix stored XSS in global settings change log Affected: 2.5.0 before 2.5.0p5; 2.4.0 before 2.4.0p31; 2.3.0 before 2.3.0p48; 2.2.0 |
| CVE-2024-28832 | 4.8 | Jun 25 | XSS in Crash Report Page Affected: 2.3.0 before 2.3.0p7; 2.2.0 before 2.2.0p28; 2.1.0 before 2.1.0p45; 2.0.0 through 2.0.0p39 |
| CVE-2025-64996 | 4.4 | Nov 18 | Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output Affected: 2.4.0 before 2.4.0p16; 2.3.0 before 2.3.0p41; 2.2.0; 2.1.0 |
| CVE-2024-38862 | 4.4 | Oct 14 | SNMP and IMPI secrets written to audit log Affected: 2.0.0 through 2.0.0p39; 2.1.0 before 2.1.0p48; 2.2.0 before 2.2.0p35; 2.3.0 before 2.3.0p18 |
| CVE-2026-2859 | 4.3 | Mar 13 | Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint Affected: 2.4.0 before 2.4.0p23; 2.3.0 before 2.3.0p43; 2.2.0 |
| CVE-2026-24097 | 4.3 | Mar 13 | Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint Affected: 2.4.0 before 2.4.0p23; 2.3.0 before 2.3.0p43; 2.2.0 |
| CVE-2025-32916 | 4.3 | Oct 9 | Sensitive form data in URL query parameters Affected: 2.4.0 before 2.4.0p13; 2.3.0 before 2.3.0p38; 2.2.0 before 2.2.0p46; 2.1.0 |
| CVE-2024-38864 | 3.3 | Dec 19 | User-Readable Private Key in Windows Agent Affected: 2.3.0 before 2.3.0p23; 2.2.0 before 2.2.0p38; 2.1.0 before 2.1.0p50 |
| CVE-2024-28830 | 2.7 | Jun 26 | Automation user secrets written to audit log Affected: 2.3.0 before 2.3.0p7; 2.2.0 before 2.2.0p28; 2.1.0 before 2.1.0p45; 2.0.0 through 2.0.0p39 |
| CVE-2026-7485 | 2.3 | Aug 20 | Frozen BI aggregations leak host and service names to unauthorized users Affected: 2.5.0 before 2.5.0p2; 2.4.0 before 2.4.0p29; 2.3.0 before 2.3.0p47; 2.2.0 |