CVE-2026-33276

8.6 highEPSS 0.1%

High (8.6) in checkmk checkmk. EPSS 0.1% chance of exploitation in the next 30 days.

Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-03-31
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

checkmk:checkmk

References

https://checkmk.com/werk/19525

Check your stack JSON