checkmk 2.2.0 Patch 38
Approved changes feed: RSS · Atom
cpe:2.3:a:checkmk:checkmk:2.2.0:p38:*:*:*:*:*:*
part: a version: 2.2.0 update: p38
| Vendor | Checkmk (4c044dbb-9ac1-5f9f-8fc3-779e7e40680c) |
|---|---|
| Product | Checkmk (d6ac166c-ac22-5bed-9805-e6ff22774734) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/tribe29/checkmk |
purl2cpe | 2026-06-01 10:16:57.776822 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3466 |
vulnerable | 2026-06-08 08:01:18.767345 |
Cross-site scripting in dashlet title
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
Published: 2026-04-07T12:08:50.132Z
Updated: 2026-04-22T12:26:27.839Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2859 |
vulnerable | 2026-06-08 07:55:17.659215 |
Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
Published: 2026-03-13T09:40:43.743Z
Updated: 2026-03-13T15:48:18.690Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24097 |
vulnerable | 2026-06-08 07:51:17.069757 |
Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.
Published: 2026-03-13T09:40:05.075Z
Updated: 2026-03-13T15:56:41.327Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64998 |
vulnerable | 2026-06-08 07:39:20.546626 |
Session hijacking via exposed session signing secret in distributed Checkmk setups
Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies.
Published: 2026-03-24T11:25:58.183Z
Updated: 2026-03-25T03:55:50.621Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39666 |
vulnerable | 2026-06-08 07:23:06.976020 |
omd: Local privilege escalation when executing omd commands as root
Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root.
Published: 2026-04-07T12:09:07.609Z
Updated: 2026-04-07T13:18:19.609Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39664 |
vulnerable | 2026-06-08 07:23:06.921550 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32919 |
vulnerable | 2026-06-08 07:19:01.153977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32918 |
vulnerable | 2026-06-08 07:19:01.143651 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32917 |
vulnerable | 2026-06-08 07:19:01.121235 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32916 |
vulnerable | 2026-06-08 07:19:01.083405 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32915 |
vulnerable | 2026-06-08 07:19:01.037356 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2596 |
vulnerable | 2026-06-08 07:16:57.756030 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2092 |
vulnerable | 2026-06-08 07:14:57.969636 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1712 |
vulnerable | 2026-06-08 07:08:37.833584 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1075 |
vulnerable | 2026-06-08 07:06:36.843802 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38865 |
vulnerable | 2026-06-08 06:41:48.456979 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.