{"schema_version":1,"title":"Checkmk vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in Checkmk: 2 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92882, was published on 22 September 2026.","url":"https://junglewise.ai/threats/technologies/checkmk","json_url":"https://junglewise.ai/threats/technologies/checkmk.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/checkmk","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":20,"critical":0,"exploited":0,"last_7_days":2,"last_30_days":3,"last_90_days":8,"last_365_days":20},"latest":[{"cve":"CVE-2026-92882","epss":0.0035,"slug":"cve-2026-92882-insufficiently-protected-credentials-in-the-host-and-folder","title":"Checkmk REST API credential exposure in host configuration","severity":"info","exploited":false,"published_at":"2026-09-22T11:17:26.497+00:00","url":"https://junglewise.ai/threats/cve-2026-92882-insufficiently-protected-credentials-in-the-host-and-folder"},{"cve":"CVE-2026-90990","epss":0.0042,"slug":"cve-2026-90990-improper-neutralization-of-newlines-in-filter-values-in-the","title":"Checkmk Livestatus injection in monitoring filter values","severity":"info","exploited":false,"published_at":"2026-09-22T11:17:25.96+00:00","url":"https://junglewise.ai/threats/cve-2026-90990-improper-neutralization-of-newlines-in-filter-values-in-the"},{"cve":"CVE-2026-15937","cvss":5.3,"epss":0.0014,"slug":"cve-2026-15937-checkmk-improper-certificate-validation-in-agent-receiver","title":"Checkmk improper certificate validation in agent receiver","severity":"info","exploited":false,"published_at":"2026-09-04T09:17:10.41+00:00","url":"https://junglewise.ai/threats/cve-2026-15937-checkmk-improper-certificate-validation-in-agent-receiver"},{"cve":"CVE-2026-17548","cvss":5.3,"epss":0.0021,"slug":"cve-2026-17548-checkmk-missing-authorization-in-background-job-viewing","title":"Checkmk missing authorization in background job viewing","severity":"info","exploited":false,"published_at":"2026-08-25T09:17:30.55+00:00","url":"https://junglewise.ai/threats/cve-2026-17548-checkmk-missing-authorization-in-background-job-viewing"},{"cve":"CVE-2026-7485","cvss":2.3,"epss":0.0035,"slug":"cve-2026-7485-checkmk-incorrect-authorization-in-frozen-bi-aggregations","title":"Checkmk incorrect authorization in frozen BI aggregations","severity":"info","exploited":false,"published_at":"2026-08-20T13:19:07.817+00:00","url":"https://junglewise.ai/threats/cve-2026-7485-checkmk-incorrect-authorization-in-frozen-bi-aggregations"},{"cve":"CVE-2026-15227","cvss":5.3,"slug":"cve-2026-15227-checkmk-missing-authorization-in-reporting-component","title":"Checkmk missing authorization in reporting component","severity":"info","exploited":false,"published_at":"2026-07-31T13:17:19.593+00:00","url":"https://junglewise.ai/threats/cve-2026-15227-checkmk-missing-authorization-in-reporting-component"},{"cve":"CVE-2026-8593","cvss":5.3,"slug":"cve-2026-8593-checkmk-improper-permission-enforcement-in-business-intelligence","title":"Checkmk improper permission enforcement in Business Intelligence API","severity":"info","exploited":false,"published_at":"2026-07-21T08:16:35.013+00:00","url":"https://junglewise.ai/threats/cve-2026-8593-checkmk-improper-permission-enforcement-in-business-intelligence"},{"cve":"CVE-2026-14852","cvss":5.2,"slug":"cve-2026-14852-checkmk-privilege-escalation-in-mk-sap-hana-agent-plugin","title":"Checkmk privilege escalation in mk_sap_hana agent plugin","severity":"info","exploited":false,"published_at":"2026-07-14T10:16:31.117+00:00","url":"https://junglewise.ai/threats/cve-2026-14852-checkmk-privilege-escalation-in-mk-sap-hana-agent-plugin"},{"cve":"CVE-2026-9549","cvss":4.8,"slug":"cve-2026-9549-checkmk-stored-xss-in-service-discovery-active-check-output","title":"Checkmk stored XSS in service discovery active check output","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:34.03+00:00","url":"https://junglewise.ai/threats/cve-2026-9549-checkmk-stored-xss-in-service-discovery-active-check-output"},{"cve":"CVE-2026-8833","cvss":8.5,"slug":"cve-2026-8833-checkmk-cross-site-scripting-via-url-validation-bypass","title":"Checkmk cross-site scripting via URL validation bypass","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.9+00:00","url":"https://junglewise.ai/threats/cve-2026-8833-checkmk-cross-site-scripting-via-url-validation-bypass"},{"cve":"CVE-2026-8078","cvss":4.8,"slug":"cve-2026-8078-checkmk-stored-xss-in-global-settings-change-log","title":"Checkmk stored XSS in global settings change log","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.76+00:00","url":"https://junglewise.ai/threats/cve-2026-8078-checkmk-stored-xss-in-global-settings-change-log"},{"cve":"CVE-2026-7765","cvss":6.3,"slug":"cve-2026-7765-checkmk-incorrect-authorization-in-user-messages-dashboard-widget","title":"Checkmk incorrect authorization in User Messages dashboard widget","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.627+00:00","url":"https://junglewise.ai/threats/cve-2026-7765-checkmk-incorrect-authorization-in-user-messages-dashboard-widget"},{"cve":"CVE-2026-7186","cvss":8.5,"slug":"cve-2026-7186-checkmk-stored-xss-in-url-dashboard-widget","title":"Checkmk stored XSS in URL dashboard widget","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.48+00:00","url":"https://junglewise.ai/threats/cve-2026-7186-checkmk-stored-xss-in-url-dashboard-widget"},{"cve":"CVE-2024-47091","cvss":5.2,"slug":"cve-2024-47091-checkmk-mk-mysql-agent-plugin-privilege-escalation-on-windows","title":"Checkmk mk_mysql agent plugin privilege escalation on Windows","severity":"info","exploited":false,"published_at":"2026-05-13T10:16:14.46+00:00","url":"https://junglewise.ai/threats/cve-2024-47091-checkmk-mk-mysql-agent-plugin-privilege-escalation-on-windows"},{"cve":"CVE-2026-33457","cvss":6.3,"slug":"cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page","title":"Checkmk Livestatus injection in prediction graph page","severity":"medium","exploited":false,"published_at":"2026-04-10T09:16:24.63+00:00","url":"https://junglewise.ai/threats/cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page"},{"cve":"CVE-2026-33456","cvss":7.6,"slug":"cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode","title":"Checkmk Livestatus injection in notification test mode","severity":"high","exploited":false,"published_at":"2026-04-10T09:16:24.493+00:00","url":"https://junglewise.ai/threats/cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode"},{"cve":"CVE-2026-33455","cvss":6.3,"slug":"cve-2026-33455-checkmk-livestatus-injection-in-monitoring-quicksearch","title":"Checkmk Livestatus injection in monitoring quicksearch","severity":"medium","exploited":false,"published_at":"2026-04-10T09:16:23.447+00:00","url":"https://junglewise.ai/threats/cve-2026-33455-checkmk-livestatus-injection-in-monitoring-quicksearch"},{"cve":"CVE-2026-33276","cvss":5.4,"epss":0.0014,"slug":"cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names","title":"Checkmk stored XSS in Unified Search via host or service names","severity":"medium","exploited":false,"published_at":"2026-03-31T15:16:14.173+00:00","url":"https://junglewise.ai/threats/cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names"},{"cve":"CVE-2026-20915","cvss":5.4,"epss":0.0015,"slug":"cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar","title":"Checkmk stored XSS in Pending Changes sidebar","severity":"medium","exploited":false,"published_at":"2026-03-31T15:16:11.527+00:00","url":"https://junglewise.ai/threats/cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar"},{"cve":"CVE-2025-64998","cvss":7.2,"slug":"cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure","title":"Checkmk session hijacking via session signing secret exposure","severity":"high","exploited":false,"published_at":"2026-03-24T12:16:11.93+00:00","url":"https://junglewise.ai/threats/cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Checkmk","slug":"checkmk","vendor":{"name":"Checkmk","slug":"checkmk","url":"https://junglewise.ai/threats/vendors/checkmk"},"aliases":[],"category":"monitoring-software","homepage":"https://checkmk.com/","repo_url":"https://github.com/Checkmk/checkmk","description":"Checkmk is an IT monitoring platform for infrastructure and application monitoring.","url":"https://junglewise.ai/threats/technologies/checkmk"},"most_severe":[{"cve":"CVE-2026-33456","cvss":7.6,"slug":"cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode","title":"Checkmk Livestatus injection in notification test mode","severity":"high","exploited":false,"published_at":"2026-04-10T09:16:24.493+00:00","url":"https://junglewise.ai/threats/cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode"},{"cve":"CVE-2025-64998","cvss":7.2,"slug":"cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure","title":"Checkmk session hijacking via session signing secret exposure","severity":"high","exploited":false,"published_at":"2026-03-24T12:16:11.93+00:00","url":"https://junglewise.ai/threats/cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure"},{"cve":"CVE-2026-33457","cvss":6.3,"slug":"cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page","title":"Checkmk Livestatus injection in prediction graph page","severity":"medium","exploited":false,"published_at":"2026-04-10T09:16:24.63+00:00","url":"https://junglewise.ai/threats/cve-2026-33457-checkmk-livestatus-injection-in-prediction-graph-page"},{"cve":"CVE-2026-33455","cvss":6.3,"slug":"cve-2026-33455-checkmk-livestatus-injection-in-monitoring-quicksearch","title":"Checkmk Livestatus injection in monitoring quicksearch","severity":"medium","exploited":false,"published_at":"2026-04-10T09:16:23.447+00:00","url":"https://junglewise.ai/threats/cve-2026-33455-checkmk-livestatus-injection-in-monitoring-quicksearch"},{"cve":"CVE-2026-20915","cvss":5.4,"epss":0.0015,"slug":"cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar","title":"Checkmk stored XSS in Pending Changes sidebar","severity":"medium","exploited":false,"published_at":"2026-03-31T15:16:11.527+00:00","url":"https://junglewise.ai/threats/cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar"},{"cve":"CVE-2026-33276","cvss":5.4,"epss":0.0014,"slug":"cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names","title":"Checkmk stored XSS in Unified Search via host or service names","severity":"medium","exploited":false,"published_at":"2026-03-31T15:16:14.173+00:00","url":"https://junglewise.ai/threats/cve-2026-33276-checkmk-stored-xss-in-unified-search-via-host-or-service-names"},{"cve":"CVE-2026-8833","cvss":8.5,"slug":"cve-2026-8833-checkmk-cross-site-scripting-via-url-validation-bypass","title":"Checkmk cross-site scripting via URL validation bypass","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.9+00:00","url":"https://junglewise.ai/threats/cve-2026-8833-checkmk-cross-site-scripting-via-url-validation-bypass"},{"cve":"CVE-2026-7186","cvss":8.5,"slug":"cve-2026-7186-checkmk-stored-xss-in-url-dashboard-widget","title":"Checkmk stored XSS in URL dashboard widget","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.48+00:00","url":"https://junglewise.ai/threats/cve-2026-7186-checkmk-stored-xss-in-url-dashboard-widget"},{"cve":"CVE-2026-7765","cvss":6.3,"slug":"cve-2026-7765-checkmk-incorrect-authorization-in-user-messages-dashboard-widget","title":"Checkmk incorrect authorization in User Messages dashboard widget","severity":"info","exploited":false,"published_at":"2026-06-08T13:16:33.627+00:00","url":"https://junglewise.ai/threats/cve-2026-7765-checkmk-incorrect-authorization-in-user-messages-dashboard-widget"},{"cve":"CVE-2026-17548","cvss":5.3,"epss":0.0021,"slug":"cve-2026-17548-checkmk-missing-authorization-in-background-job-viewing","title":"Checkmk missing authorization in background job viewing","severity":"info","exploited":false,"published_at":"2026-08-25T09:17:30.55+00:00","url":"https://junglewise.ai/threats/cve-2026-17548-checkmk-missing-authorization-in-background-job-viewing"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}