CVE WatchJul 23, 2026

CVE-2026-8078

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an ad

CVSS

4.8

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Jun 8, 2026 · Last modified: Jul 23, 2026 · CWE-79

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-06-302026-07-26

Technical description

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Official references

checkmk.comhttps://checkmk.com/werk/17992

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-654486.5 MED

—

———Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.1h CVE-2026-654477.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.1h CVE-2026-654467.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.1h CVE-2026-654437.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.1h CVE-2026-654417.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.1h CVE-2026-654407.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.1h