Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,499All CVEsplus 19,165 rejected
- 570Last 24 hours4,924 in the last 7 days
- 18,684Last 30 days1,587 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 9 | 23 | 4 | 0 | 40 | 108 |
| 2025 | 0 | 6 | 18 | 3 | 0 | 27 | 68 |
| 2024 | 1 | 10 | 20 | 4 | 0 | 35 | 41 |
| 2023 | 0 | 3 | 0 | 3 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-118965 | Path traversal in host label synchronization allows code execution on the central site from a remote siteCheckmk GmbH · Checkmk | Critical9.4 |
| CVE-2026-120495 | Arbitrary file write and code execution via crafted Synthetic Monitoring agent dataCheckmk GmbH · Checkmk | Critical9.4 |
| CVE-2026-121374 | Arbitrary file write and code execution via excluded node roles in Kubernetes special agentCheckmk GmbH · Checkmk | Critical9.4 |
| CVE-2026-111573 | Privilege escalation via unprotected Windows agent data folderCheckmk GmbH · Checkmk | Medium6.3 |
| CVE-2026-103682 | Jolokia special agent exposes password in process listCheckmk GmbH · Checkmk | Low2.0 |
| CVE-2026-103674 | NetApp ONTAP special agent exposes password in process listCheckmk GmbH · Checkmk | Low2.0 |
| CVE-2026-117611 | Trust of compromised eMudhra root CA in bundled CA storesCheckmk GmbH · Checkmk | High7.1 |
| CVE-2026-113461 | mk-oracle: Local privilege escalation via insecure Oracle Home library loadingCheckmk GmbH · Checkmk | Medium5.2 |
| CVE-2026-14452 | Open redirect and XSS via reset_url parameterCheckmk GmbH · Checkmk | High8.6 |
| CVE-2026-105331 | mk-oracle: Local privilege escalation via malicious Oracle Instant ClientCheckmk GmbH · Checkmk | Medium5.2 |
| CVE-2026-90990 | Livestatus injection via monitoring filter valuesCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-92882 | Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesCheckmk GmbH · Checkmk | Low2.3 |
| CVE-2026-77021 | Missing decompression size limit in agent receiver allows memory exhaustion via push agent dataCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-15937 | Agent receiver certificate confusion allows authentication with a certificate issued for another endpointCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-17548 | Missing authorization for viewing background jobsCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-15576 | Agent receiver accepts mTLS requests without a client certificateCheckmk GmbH · Checkmk | Medium6.9 |
| CVE-2026-7485 | Frozen BI aggregations leak host and service names to unauthorized usersCheckmk GmbH · Checkmk | Low2.3 |
| CVE-2026-15227 | Missing Authorization Allows Editing of Foreign ReportsCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-8593 | Fix Business Intelligence API Pack permissionCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-14852 | mk_sap_hana: Privilege escalation via crafted sapstartsrv process nameCheckmk GmbH · Checkmk | Medium5.2 |
| CVE-2026-9549 | Fix XSS in service discovery active check outputCheckmk GmbH · Checkmk | Medium4.8 |
| CVE-2026-8833 | XSS in urlsCheckmk GmbH · Checkmk | High8.5 |
| CVE-2026-8078 | Fix stored XSS in global settings change logCheckmk GmbH · Checkmk | Medium4.8 |
| CVE-2026-7765 | User Messages widget leaked issuer messages on shared dashboardsCheckmk GmbH · Checkmk | Medium6.3 |
| CVE-2026-7186 | Fix stored XSS in URL dashboard widget via dangerous URI schemesCheckmk GmbH · Checkmk | High8.5 |
| CVE-2024-47091 | Privilege escalation via mk_mysql agent plugin on WindowsCheckmk GmbH · Checkmk | Medium5.2 |
| CVE-2026-33457 | Potential livestatus injection in prediction graph pageCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-33456 | Potential livestatus injection in notification testCheckmk GmbH · Checkmk | Medium5.1 |
| CVE-2026-33455 | Livestatus injection in monitoring quicksearchCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2025-39666 | omd: Local privilege escalation when executing omd commands as rootCheckmk GmbH · Checkmk | Critical9.3 |
| CVE-2026-3466 | Cross-site scripting in dashlet titleCheckmk GmbH · Checkmk | High8.5 |
| CVE-2026-24096 | Insufficient permission validation on multiple REST API Quick Setup endpointsCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-20915 | Stored cross-site scripting in Pending Changes sidebarCheckmk GmbH · Checkmk | High8.5 |
| CVE-2026-33276 | XSS in Unified Search via Unescaped Host/Service NamesCheckmk GmbH · Checkmk | High8.6 |
| CVE-2025-64998 | Session hijacking via exposed session signing secret in distributed Checkmk setupsCheckmk GmbH · Checkmk | High7.3 |
| CVE-2026-2859 | Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent EndpointCheckmk GmbH · Checkmk | Medium6.3 |
| CVE-2026-24097 | Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing EndpointCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2026-3103 | Deletion of passwords via RestApiCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2025-64999 | Cross-site scripting in HTML logs of Synthetic Monitoring test servicesPublic exploitCheckmk GmbH · Checkmk | High7.3 |
| CVE-2026-24095 | Missing Permission Check on Analyze Configuration PageCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2025-65000 | Exposure of SSH Private Keys in Remote Alert Handlers (Linux) RuleCheckmk GmbH · Checkmk | Low2.3 |
| CVE-2025-64997 | Insufficient permission validation when showing agent informationCheckmk GmbH · Checkmk | Medium6.3 |
| CVE-2025-39665 | Livestatus Injection in dynmapsNagvis · Nagvis | Medium6.9 |
| CVE-2025-58121 | Insufficient permission validation on multiple REST API endpointsCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2025-58122 | Insufficient permission validation when configuring notification parametersCheckmk GmbH · Checkmk | Medium5.3 |
| CVE-2025-64996 | Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's outputCheckmk GmbH · Checkmk | Medium4.8 |
| CVE-2025-39663 | Cross Site Scripting through compromised remote sitePublic exploitCheckmk GmbH · Checkmk | High8.5 |
| CVE-2025-39664 | Path-Traversal in report schedulerCheckmk GmbH · Checkmk | High7.1 |
| CVE-2025-32919 | Privilege Escalation in Windows License plugin for Checkmk Windows AgentCheckmk GmbH · Checkmk | High8.8 |
| CVE-2025-32916 | Sensitive form data in URL query parametersCheckmk GmbH · Checkmk | Low1.0 |