checkmk 2.5.0 Beta 1
Approved changes feed: RSS · Atom
cpe:2.3:a:checkmk:checkmk:2.5.0:b1:*:*:*:*:*:*
part: a version: 2.5.0 update: b1
| Vendor | Checkmk (4c044dbb-9ac1-5f9f-8fc3-779e7e40680c) |
|---|---|
| Product | Checkmk (d6ac166c-ac22-5bed-9805-e6ff22774734) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/tribe29/checkmk |
purl2cpe | 2026-06-01 10:16:57.801447 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3466 |
vulnerable | 2026-06-08 08:01:18.807088 |
Cross-site scripting in dashlet title
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
Published: 2026-04-07T12:08:50.132Z
Updated: 2026-04-22T12:26:27.839Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33457 |
vulnerable | 2026-06-08 07:59:10.116404 |
Potential livestatus injection in prediction graph page
Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.
Published: 2026-04-10T08:31:35.768Z
Updated: 2026-04-14T13:29:41.112Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33456 |
vulnerable | 2026-06-08 07:59:10.047491 |
Potential livestatus injection in notification test
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
Published: 2026-04-10T08:31:27.807Z
Updated: 2026-04-14T13:29:54.362Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33455 |
vulnerable | 2026-06-08 07:59:10.012340 |
Livestatus injection in monitoring quicksearch
Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in search filter plugins.
Published: 2026-04-10T08:30:20.089Z
Updated: 2026-04-14T13:30:16.535Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33276 |
vulnerable | 2026-06-08 07:59:09.465428 |
XSS in Unified Search via Unescaped Host/Service Names
Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.
Published: 2026-03-31T13:44:17.857Z
Updated: 2026-03-31T15:45:36.069Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24096 |
vulnerable | 2026-06-08 07:51:17.030746 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20915 |
vulnerable | 2026-06-08 07:49:13.410804 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39666 |
vulnerable | 2026-06-08 07:23:07.035316 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.