{"items":[{"id":"CVE-2026-111573","published":"2026-11-06T15:59:40.560Z","updated":"2026-11-06T16:27:41.790Z","title":"Privilege escalation via unprotected Windows agent data folder","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-103682","published":"2026-11-06T09:07:55.856Z","updated":"2026-11-06T09:07:55.856Z","title":"Jolokia special agent exposes password in process list","severity":"LOW","score":2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-103674","published":"2026-11-06T09:06:40.803Z","updated":"2026-11-06T09:06:40.803Z","title":"NetApp ONTAP special agent exposes password in process list","severity":"LOW","score":2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-117611","published":"2026-10-29T09:32:57.964Z","updated":"2026-10-29T14:13:09.797Z","title":"Trust of compromised eMudhra root CA in bundled CA stores","severity":"HIGH","score":7.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-113461","published":"2026-10-21T18:11:34.774Z","updated":"2026-10-23T11:06:22.616Z","title":"mk-oracle: Local privilege escalation via insecure Oracle Home library loading","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-14452","published":"2026-10-16T09:51:30.453Z","updated":"2026-10-16T10:40:17.160Z","title":"Open redirect and XSS via reset_url parameter","severity":"HIGH","score":8.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-105331","published":"2026-10-08T14:19:41.627Z","updated":"2026-10-09T03:55:47.530Z","title":"mk-oracle: Local privilege escalation via malicious Oracle Instant Client","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00084,"kevAdded":null},{"id":"CVE-2026-90990","published":"2026-09-22T10:43:28.959Z","updated":"2026-09-22T13:04:48.692Z","title":"Livestatus injection via monitoring filter values","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-92882","published":"2026-09-22T10:42:59.432Z","updated":"2026-10-05T14:14:15.352Z","title":"Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses","severity":"LOW","score":2.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-77021","published":"2026-09-21T10:57:37.433Z","updated":"2026-09-21T19:40:26.202Z","title":"Missing decompression size limit in agent receiver allows memory exhaustion via push agent data","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-15937","published":"2026-09-04T08:24:49.802Z","updated":"2026-09-04T19:39:28.278Z","title":"Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-17548","published":"2026-08-25T08:35:17.301Z","updated":"2026-08-25T19:48:40.302Z","title":"Missing authorization for viewing background jobs","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-15576","published":"2026-08-21T11:10:00.856Z","updated":"2026-08-21T11:53:45.355Z","title":"Agent receiver accepts mTLS requests without a client certificate","severity":"MEDIUM","score":6.9,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00453,"kevAdded":null},{"id":"CVE-2026-7485","published":"2026-08-20T12:12:52.811Z","updated":"2026-08-26T14:16:37.692Z","title":"Frozen BI aggregations leak host and service names to unauthorized users","severity":"LOW","score":2.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-15227","published":"2026-07-31T12:21:58.292Z","updated":"2026-07-31T19:50:52.858Z","title":"Missing Authorization Allows Editing of Foreign Reports","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-8593","published":"2026-07-21T07:20:35.400Z","updated":"2026-07-21T12:16:52.202Z","title":"Fix Business Intelligence API Pack permission","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-14852","published":"2026-07-14T09:26:28.525Z","updated":"2026-07-29T19:26:45.645Z","title":"mk_sap_hana: Privilege escalation via crafted sapstartsrv process name","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-9549","published":"2026-06-08T12:07:12.356Z","updated":"2026-06-08T13:02:20.748Z","title":"Fix XSS in service discovery active check output","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-8833","published":"2026-06-08T12:06:51.267Z","updated":"2026-06-08T13:02:45.679Z","title":"XSS in urls","severity":"HIGH","score":8.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-8078","published":"2026-06-08T12:06:36.666Z","updated":"2026-06-08T13:03:18.164Z","title":"Fix stored XSS in global settings change log","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-7765","published":"2026-06-08T12:06:02.840Z","updated":"2026-06-08T13:04:57.779Z","title":"User Messages widget leaked issuer messages on shared dashboards","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-7186","published":"2026-06-08T12:05:28.554Z","updated":"2026-06-08T13:15:47.369Z","title":"Fix stored XSS in URL dashboard widget via dangerous URI schemes","severity":"HIGH","score":8.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2024-47091","published":"2026-05-13T08:35:25.850Z","updated":"2026-05-13T12:01:57.840Z","title":"Privilege escalation via mk_mysql agent plugin on Windows","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-33457","published":"2026-04-10T08:31:35.768Z","updated":"2026-04-14T13:29:41.112Z","title":"Potential livestatus injection in prediction graph page","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-33456","published":"2026-04-10T08:31:27.807Z","updated":"2026-04-14T13:29:54.362Z","title":"Potential livestatus injection in notification test","severity":"MEDIUM","score":5.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-33455","published":"2026-04-10T08:30:20.089Z","updated":"2026-04-14T13:30:16.535Z","title":"Livestatus injection in monitoring quicksearch","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-39666","published":"2026-04-07T12:09:07.609Z","updated":"2026-04-07T13:18:19.609Z","title":"omd: Local privilege escalation when executing omd commands as root","severity":"CRITICAL","score":9.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-3466","published":"2026-04-07T12:08:50.132Z","updated":"2026-04-22T12:26:27.839Z","title":"Cross-site scripting in dashlet title","severity":"HIGH","score":8.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-24096","published":"2026-04-01T10:07:21.670Z","updated":"2026-04-01T12:37:04.819Z","title":"Insufficient permission validation on multiple REST API Quick Setup endpoints","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-20915","published":"2026-03-31T13:51:02.358Z","updated":"2026-03-31T17:15:54.753Z","title":"Stored cross-site scripting in Pending Changes sidebar","severity":"HIGH","score":8.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-33276","published":"2026-03-31T13:44:17.857Z","updated":"2026-03-31T15:45:36.069Z","title":"XSS in Unified Search via Unescaped Host/Service Names","severity":"HIGH","score":8.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-64998","published":"2026-03-24T11:25:58.183Z","updated":"2026-03-25T03:55:50.621Z","title":"Session hijacking via exposed session signing secret in distributed Checkmk setups","severity":"HIGH","score":7.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-2859","published":"2026-03-13T09:40:43.743Z","updated":"2026-03-13T15:48:18.690Z","title":"Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-24097","published":"2026-03-13T09:40:05.075Z","updated":"2026-03-13T15:56:41.327Z","title":"Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-3103","published":"2026-03-04T13:15:41.086Z","updated":"2026-03-04T14:07:12.933Z","title":"Deletion of passwords via RestApi","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-64999","published":"2026-02-26T10:26:00.127Z","updated":"2026-04-14T14:28:26.527Z","title":"Cross-site scripting in HTML logs of Synthetic Monitoring test services","severity":"HIGH","score":7.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-24095","published":"2026-02-09T15:29:16.780Z","updated":"2026-02-09T15:54:18.156Z","title":"Missing Permission Check on Analyze Configuration Page","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-65000","published":"2025-12-18T14:04:12.809Z","updated":"2025-12-18T15:28:51.856Z","title":"Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule","severity":"LOW","score":2.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-64997","published":"2025-12-18T09:11:17.431Z","updated":"2025-12-18T14:27:48.647Z","title":"Insufficient permission validation when showing agent information","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-39665","published":"2025-12-03T09:55:41.096Z","updated":"2025-12-03T14:11:10.954Z","title":"Livestatus Injection in dynmaps","severity":"MEDIUM","score":6.9,"vendor":"Nagvis","product":"Nagvis","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-58121","published":"2025-11-18T15:11:35.167Z","updated":"2025-11-18T21:34:05.614Z","title":"Insufficient permission validation on multiple REST API endpoints","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-58122","published":"2025-11-18T15:11:17.244Z","updated":"2025-11-18T21:33:35.695Z","title":"Insufficient permission validation when configuring notification parameters","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-64996","published":"2025-11-18T15:10:53.398Z","updated":"2025-11-18T21:23:15.114Z","title":"Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-39663","published":"2025-10-30T10:43:08.500Z","updated":"2025-11-07T16:04:27.994Z","title":"Cross Site Scripting through compromised remote site","severity":"HIGH","score":8.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2025-39664","published":"2025-10-09T15:01:55.877Z","updated":"2025-11-03T17:42:07.064Z","title":"Path-Traversal in report scheduler","severity":"HIGH","score":7.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0071,"kevAdded":null},{"id":"CVE-2025-32919","published":"2025-10-09T15:01:42.606Z","updated":"2025-11-03T17:32:30.502Z","title":"Privilege Escalation in Windows License plugin for Checkmk Windows Agent","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-32916","published":"2025-10-09T15:00:58.720Z","updated":"2025-10-14T14:16:57.077Z","title":"Sensitive form data in URL query parameters","severity":"LOW","score":1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-58127","published":"2025-08-28T12:59:36.596Z","updated":"2025-08-28T13:12:57.409Z","title":"Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange","severity":"MEDIUM","score":6.9,"vendor":null,"product":"Dell Powerscale","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-58126","published":"2025-08-28T12:59:33.842Z","updated":"2025-08-28T13:14:16.922Z","title":"Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange","severity":"MEDIUM","score":6.9,"vendor":null,"product":"VMware vSAN","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-58125","published":"2025-08-28T12:59:31.212Z","updated":"2025-08-28T13:17:25.986Z","title":"Lack of TLS validation in plugin Freebox v6 agent on Checkmk Exchange","severity":"MEDIUM","score":6.9,"vendor":null,"product":"Freebox v6 agent","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-58124","published":"2025-08-28T12:59:28.526Z","updated":"2025-10-07T09:33:24.363Z","title":"Lack of TLS validation in plugin check-mk-api on Checkmk Exchange","severity":"MEDIUM","score":6.9,"vendor":null,"product":"check-mk-api","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-58123","published":"2025-08-28T12:59:25.737Z","updated":"2025-08-28T13:20:27.456Z","title":"Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange","severity":"MEDIUM","score":6.9,"vendor":null,"product":"BGP Monitoring","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2025-32918","published":"2025-07-04T08:12:21.950Z","updated":"2025-07-08T14:20:25.426Z","title":"Livestatus injection in autocomplete endpoint","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2024-47090","published":"2025-05-27T07:02:53.607Z","updated":"2025-11-03T19:31:16.593Z","title":"XSS via WYSIWYG editor","severity":"MEDIUM","score":5.1,"vendor":"Nagvis","product":"Nagvis","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2024-38866","published":"2025-05-27T07:01:35.160Z","updated":"2025-11-03T19:30:20.670Z","title":"Livestatus Injection in dynmaps","severity":"MEDIUM","score":5.3,"vendor":"Nagvis","product":"Nagvis","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2025-32915","published":"2025-05-22T14:16:01.214Z","updated":"2025-05-22T14:48:38.894Z","title":"Sensitive data exposed during automatic agent updates","severity":"MEDIUM","score":4.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-1712","published":"2025-05-21T09:10:42.626Z","updated":"2025-05-21T10:28:28.256Z","title":"Arbitrary file write with vcrtrace","severity":"HIGH","score":8.7,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0083,"kevAdded":null},{"id":"CVE-2025-32917","published":"2025-05-13T10:45:31.406Z","updated":"2025-05-13T13:05:57.675Z","title":"Privilege escalation in jar_signature","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-3506","published":"2025-05-08T11:24:24.682Z","updated":"2025-05-08T13:27:46.989Z","title":"Potentially senitive path exposed via unauthenticated http route","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-2092","published":"2025-04-22T11:38:04.092Z","updated":"2025-04-22T13:08:31.297Z","title":"Remote site authentication secrets written to web log","severity":"HIGH","score":7.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2024-38865","published":"2025-04-10T07:35:35.143Z","updated":"2025-04-10T13:09:56.033Z","title":"Livestatus command injection in RestAPI","severity":"MEDIUM","score":6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0088,"kevAdded":null},{"id":"CVE-2025-2596","published":"2025-03-26T10:51:16.285Z","updated":"2025-03-26T17:36:08.128Z","title":"Session logout can be overwritten by long lasting request","severity":"LOW","score":2.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2024-47092","published":"2025-03-03T13:47:18.887Z","updated":"2025-03-04T07:53:06.307Z","title":"Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api","severity":"HIGH","score":7.7,"vendor":null,"product":"check-mk-api","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2025-1075","published":"2025-02-19T09:49:55.695Z","updated":"2025-11-13T12:54:20.274Z","title":"LDAP credentials logged to Apache error log","severity":"MEDIUM","score":5.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2024-38864","published":"2024-12-19T16:07:13.213Z","updated":"2024-12-20T20:16:55.606Z","title":"User-Readable Private Key in Windows Agent","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2024-47093","published":"2024-12-19T14:08:44.081Z","updated":"2025-11-03T19:31:17.975Z","title":"Fix various XSS issues and potential RCE","severity":"HIGH","score":8.8,"vendor":"Nagvis","product":"Nagvis","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2024-47094","published":"2024-11-29T09:52:18.988Z","updated":"2025-09-11T07:16:20.513Z","title":"Logging of sitesecret to automations log","severity":"MEDIUM","score":5.7,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2024-38863","published":"2024-10-14T07:19:07.625Z","updated":"2024-10-14T15:34:11.188Z","title":"CSRF token leaked in URL parameters","severity":"LOW","score":2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2024-38862","published":"2024-10-14T07:19:01.674Z","updated":"2024-10-14T15:34:37.344Z","title":"SNMP and IMPI secrets written to audit log","severity":"MEDIUM","score":5.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2024-6747","published":"2024-10-10T07:43:48.050Z","updated":"2024-10-10T13:44:21.470Z","title":"Information leak in mknotifyd","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2024-38861","published":"2024-09-27T08:11:46.790Z","updated":"2024-09-27T15:21:54.470Z","title":"Lack of TLS validation in plugin MikroTik on Checkmk Exchange","severity":"MEDIUM","score":4.9,"vendor":null,"product":"MikroTik","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2024-8606","published":"2024-09-23T07:01:04.769Z","updated":"2024-09-23T15:33:22.875Z","title":"Fix 2FA bypass via RestAPI","severity":"CRITICAL","score":9.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2024-38860","published":"2024-09-17T14:01:09.555Z","updated":"2024-09-17T17:16:28.885Z","title":"Reflected links in error message facilitate phishing attacks","severity":"MEDIUM","score":5.1,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2024-6572","published":"2024-09-09T09:39:17.769Z","updated":"2024-09-09T13:03:22.065Z","title":"Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'","severity":"MEDIUM","score":6.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2024-38858","published":"2024-09-02T09:16:40.902Z","updated":"2024-09-03T14:08:05.571Z","title":"Cross-site scripting in Robotmk logs view","severity":"LOW","score":2.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2024-38859","published":"2024-08-26T14:15:32.555Z","updated":"2024-08-26T15:22:30.830Z","title":"XSS in view page with SLA column","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2024-28829","published":"2024-08-20T09:29:26.474Z","updated":"2024-08-21T19:37:32.708Z","title":"Privilege escalation in mk_informix plugin","severity":"MEDIUM","score":5.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2024-6542","published":"2024-07-22T09:50:17.736Z","updated":"2024-08-01T21:41:03.497Z","title":"Livestatus injection in mknotifyd","severity":"MEDIUM","score":6.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2024-28828","published":"2024-07-10T12:41:13.934Z","updated":"2024-08-02T00:56:58.057Z","title":"1-Click compromize via CSRF","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2024-28827","published":"2024-07-10T12:41:04.948Z","updated":"2024-08-02T00:56:58.208Z","title":"Privilege escalation in Windows agent","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2024-6163","published":"2024-07-08T13:01:38.306Z","updated":"2025-08-27T21:43:05.853Z","title":"local IP restriction of internal HTTP endpoints","severity":"MEDIUM","score":5.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2024-6052","published":"2024-07-03T14:30:31.332Z","updated":"2024-09-16T13:57:30.913Z","title":"XSS in SQL check parameters","severity":"MEDIUM","score":6.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2024-38857","published":"2024-07-02T08:11:19.241Z","updated":"2024-08-02T04:19:20.353Z","title":"Reflected links in visuals facilitate phishing attacks","severity":"MEDIUM","score":4.3,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2024-28830","published":"2024-06-26T07:56:57.020Z","updated":"2024-08-02T00:56:58.058Z","title":"Automation user secrets written to audit log","severity":"LOW","score":2.7,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2024-28832","published":"2024-06-25T11:45:33.371Z","updated":"2024-08-02T00:56:58.120Z","title":"XSS in Crash Report Page","severity":"MEDIUM","score":4.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2024-28831","published":"2024-06-25T11:45:27.259Z","updated":"2024-08-02T00:56:58.164Z","title":"XSS in confirmation pop-up","severity":"MEDIUM","score":5.4,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2024-5741","published":"2024-06-17T11:16:59.771Z","updated":"2024-08-01T21:18:07.062Z","title":"XSS in inventory view","severity":"MEDIUM","score":6.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2024-28833","published":"2024-06-10T11:55:50.571Z","updated":"2024-08-02T00:56:58.393Z","title":"Missing brute-force protection for two factor authentication","severity":"MEDIUM","score":5.9,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2024-28826","published":"2024-05-29T10:00:53.789Z","updated":"2024-08-02T00:56:58.127Z","title":"Unrestricted upload and download paths in check_sftp","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2024-28825","published":"2024-04-24T11:25:36.306Z","updated":"2024-08-02T00:56:58.650Z","title":"Brute-force protection ineffective for some login methods","severity":"MEDIUM","score":5.9,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2024-3367","published":"2024-04-16T11:59:43.845Z","updated":"2024-08-26T09:48:37.438Z","title":"Argument injection to runmqsc","severity":"MEDIUM","score":6.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2024-2380","published":"2024-04-05T13:01:08.382Z","updated":"2024-08-01T19:11:53.480Z","title":"XSS in graph rendering","severity":"MEDIUM","score":4.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2024-28824","published":"2024-03-22T10:26:35.280Z","updated":"2024-08-02T00:56:58.156Z","title":"Privilege escalation in mk_informix plugin","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2024-1742","published":"2024-03-22T10:26:06.238Z","updated":"2024-08-12T18:34:37.823Z","title":"Information disclosure in mk_oracle Checkmk agent plugin","severity":"LOW","score":3.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2024-0638","published":"2024-03-22T10:25:35.675Z","updated":"2024-08-02T14:54:20.182Z","title":"Privilege escalation in mk_oracle plugins","severity":"HIGH","score":8.2,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2024-0670","published":"2024-03-11T14:50:59.415Z","updated":"2025-02-13T17:27:13.277Z","title":"Privilege escalation in windows agent","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2023-6740","published":"2024-01-12T07:50:20.076Z","updated":"2025-06-03T14:05:24.299Z","title":"Privilege escalation in jar_signature","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2023-6735","published":"2024-01-12T07:50:05.450Z","updated":"2025-06-03T14:05:30.852Z","title":"Privilege escalation in mk_tsm","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2023-31211","published":"2024-01-12T07:49:45.294Z","updated":"2025-06-17T21:09:17.486Z","title":"Disabled automation users could still authenticate","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2023-31210","published":"2023-12-13T08:26:46.452Z","updated":"2024-12-02T14:29:06.806Z","title":"Privilege escalation in agent via LD_LIBRARY_PATH","severity":"HIGH","score":8.8,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2023-6287","published":"2023-11-27T14:04:01.568Z","updated":"2024-08-26T09:47:54.792Z","title":"Backup password in GET parameter","severity":"LOW","score":3.3,"vendor":"Checkmk GmbH","product":"Checkmk Appliance","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2023-6251","published":"2023-11-24T08:16:23.663Z","updated":"2024-08-02T08:21:18.099Z","title":"CSRF in delete_user_message","severity":"LOW","score":3.5,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-6157","published":"2023-11-22T16:24:22.002Z","updated":"2024-08-02T08:21:17.625Z","title":"Livestatus injection in ajax_search","severity":"HIGH","score":7.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00888,"kevAdded":null},{"id":"CVE-2023-6156","published":"2023-11-22T16:24:15.515Z","updated":"2024-08-02T08:21:17.614Z","title":"Livestatus injection in availability timeline","severity":"HIGH","score":7.6,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00857,"kevAdded":null},{"id":"CVE-2023-23549","published":"2023-11-15T11:07:28.671Z","updated":"2024-08-28T20:25:01.313Z","title":"DoS via long hostnames","severity":"LOW","score":2.7,"vendor":"Checkmk GmbH","product":"Checkmk","kev":false,"epss":0.00648,"kevAdded":null}]}