Product by Checkmk Gmbh
Checkmk
94 known vulnerabilities in Checkmk (Checkmk Gmbh), 0 of them actively exploited (CISA KEV).
Key figures
94
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-31209 | Command injection via active checks and REST API | 8.8 | |
| High | CVE-2024-38865 | Livestatus command injection in RestAPI | 8.8 | |
| High | CVE-2025-1712 | Arbitrary file write with vcrtrace | 8.8 | |
| High | CVE-2023-31208 | Livestatus command injection in RestAPI | 8.8 | |
| High | CVE-2026-14452 | Open redirect and XSS via reset_url parameter | — | |
| High | CVE-2025-39663 | Cross Site Scripting through compromised remote site | 8.4 | |
| Medium | CVE-2026-15576 | Agent receiver accepts mTLS requests without a client certificate | — | |
| High | CVE-2023-6157 | Livestatus injection in ajax_search | 7.6 | |
| High | CVE-2025-39664 | Path-Traversal in report scheduler | 6.5 | |
| High | CVE-2023-6156 | Livestatus injection in availability timeline | 7.6 | |
| High | CVE-2026-117611 | Trust of compromised eMudhra root CA in bundled CA stores | — | |
| Critical | CVE-2024-8606 | Fix 2FA bypass via RestAPI | 8.8 | |
| Medium | CVE-2026-90990 | Livestatus injection via monitoring filter values | — | |
| High | CVE-2023-31210 | Privilege escalation in agent via LD_LIBRARY_PATH | 8.8 | |
| High | CVE-2023-31211 | Disabled automation users could still authenticate | 8.8 | |
| High | CVE-2024-28826 | Unrestricted upload and download paths in check_sftp | 8.8 | |
| High | CVE-2025-32918 | Livestatus injection in autocomplete endpoint | 8.8 | |
| Medium | CVE-2026-77021 | Missing decompression size limit in agent receiver allows memory exhaustion via push agent data | — | |
| Critical | CVE-2025-39666 | omd: Local privilege escalation when executing omd commands as root | 7.3 | |
| High | CVE-2026-24096 | Insufficient permission validation on multiple REST API Quick Setup endpoints | 8.8 | |
| High | CVE-2026-8833 | XSS in urls | 5.4 | |
| High | CVE-2026-7186 | Fix stored XSS in URL dashboard widget via dangerous URI schemes | 5.4 | |
| High | CVE-2026-3466 | Cross-site scripting in dashlet title | 5.4 | |
| High | CVE-2026-33276 | XSS in Unified Search via Unescaped Host/Service Names | 5.4 | |
| High | CVE-2025-32919 | Privilege Escalation in Windows License plugin for Checkmk Windows Agent | 7.8 |