Check_mk
125 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Check_mk, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.
Check_mk CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 1 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 1 |
| 2025-04 | 2 |
| 2025-05 | 4 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 4 |
| 2025-11 | 3 |
| 2025-12 | 2 |
| 2026-01 | 0 |
| 2026-02 | 2 |
| 2026-03 | 6 |
| 2026-04 | 6 |
| 2026-05 | 1 |
| 2026-06 | 5 |
| 2026-07 | 3 |
| 2026-08 | 3 |
| 2026-09 | 4 |
| 2026-10 | 3 |
Severity
How the 125 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High41
- Medium62
- Low7
Latest CVEs
The 15 most recently published vulnerabilities affecting Check_mk.
- CVE-2026-113461mk-oracle: Local privilege escalation via insecure Oracle Home library loading—
- CVE-2026-14452Open redirect and XSS via reset_url parameter—
- CVE-2026-105331mk-oracle: Local privilege escalation via malicious Oracle Instant Client—
- CVE-2026-90990Livestatus injection via monitoring filter values—
- CVE-2026-92882Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses—
- CVE-2026-77021Missing decompression size limit in agent receiver allows memory exhaustion via push agent data—
- CVE-2026-15937Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint—
- CVE-2026-17548Missing authorization for viewing background jobs—
- CVE-2026-15576Agent receiver accepts mTLS requests without a client certificate—
- CVE-2026-7485Frozen BI aggregations leak host and service names to unauthorized users—
- CVE-2026-15227Missing Authorization Allows Editing of Foreign Reports—
- CVE-2026-8593Fix Business Intelligence API Pack permission—
- CVE-2026-14852mk_sap_hana: Privilege escalation via crafted sapstartsrv process name—
- CVE-2026-9549Fix XSS in service discovery active check output4.8
- CVE-2026-8833XSS in urls5.4
Product grouping is registry-driven, with AI assist and human review. How it works