CVE Watch23 jul 2026

CVE-2026-8078

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an ad

CVSS

4.8

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 8 jun 2026 · Última mod.: 23 jul 2026 · CWE-79

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-06-302026-07-26

Descripción técnica

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Referencias oficiales

checkmk.comhttps://checkmk.com/werk/17992

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-654486.5 MED

—

———Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.3h CVE-2026-654477.1 ALT

—

———Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.3h CVE-2026-654467.1 ALT

—

———Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.3h CVE-2026-654437.1 ALT

—

———Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.3h CVE-2026-654417.1 ALT

—

———Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.3h CVE-2026-654407.1 ALT

—

———Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.3h