Approved changes feed: RSS · Atom
cpe:2.3:a:checkmk:checkmk:2.2.0:*:*:*:*:*:*:*
part: a version: 2.2.0 update: *
| Vendor | Checkmk (4c044dbb-9ac1-5f9f-8fc3-779e7e40680c) |
|---|---|
| Product | Checkmk (d6ac166c-ac22-5bed-9805-e6ff22774734) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/tribe29/checkmk |
purl2cpe | 2026-06-01 10:16:57.776765 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9549 |
vulnerable | 2026-07-29 01:09:07.160780 |
Fix XSS in service discovery active check output
Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check output that executes in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.
Published: 2026-06-08T12:07:12.356Z
Updated: 2026-06-08T13:02:20.748Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8833 |
vulnerable | 2026-07-29 01:09:06.307933 |
XSS in urls
Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another user interacts with the crafted link.
Published: 2026-06-08T12:06:51.267Z
Updated: 2026-06-08T13:02:45.679Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8078 |
vulnerable | 2026-07-29 01:09:05.520877 |
Fix stored XSS in global settings change log
Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.
Published: 2026-06-08T12:06:36.666Z
Updated: 2026-06-08T13:03:18.164Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7186 |
vulnerable | 2026-07-29 01:09:04.277941 |
Fix stored XSS in URL dashboard widget via dangerous URI schemes
Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.
Published: 2026-06-08T12:05:28.554Z
Updated: 2026-06-08T13:15:47.369Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14852 |
vulnerable | 2026-07-29 00:26:17.611585 |
mk_sap_hana: Privilege escalation via crafted sapstartsrv process name
Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database configuration, the mk_sap_hana agent plugin derives instance identifiers from the process list and uses them to build a command executed with elevated privileges (requires the plugin to run as root with RUNAS=agent).
Published: 2026-07-14T09:26:28.525Z
Updated: 2026-07-29T19:26:45.645Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3466 |
vulnerable | 2026-06-08 08:01:18.728326 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3103 |
vulnerable | 2026-06-08 08:01:17.758930 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2859 |
vulnerable | 2026-06-08 07:55:17.616244 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24097 |
vulnerable | 2026-06-08 07:51:17.031805 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24095 |
vulnerable | 2026-06-08 07:51:17.000616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65000 |
vulnerable | 2026-06-08 07:39:20.599264 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64997 |
vulnerable | 2026-06-08 07:39:20.495184 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64996 |
vulnerable | 2026-06-08 07:39:20.428872 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58121 |
vulnerable | 2026-06-08 07:35:17.232581 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39666 |
vulnerable | 2026-06-08 07:23:06.954765 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47091 |
vulnerable | 2026-06-08 06:48:11.281790 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3367 |
vulnerable | 2026-06-08 06:41:53.025887 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28827 |
vulnerable | 2026-06-08 06:33:27.540955 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28826 |
vulnerable | 2026-06-08 06:33:27.518371 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28825 |
vulnerable | 2026-06-08 06:33:27.494259 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.