CVE-2026-113461

MediumCVSS 5.2/10Last modified Oct 23, 2026

Description

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Metrics

CVSS 4.0 5.2/10

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-426 CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1134656.6It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnera CVE-2026-1134665.3A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/S CVE-2026-1134686.9The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visit CVE-2026-1134697.5A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine r CVE-2026-113478.5The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charse CVE-2026-1134705.4Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Fi CVE-2026-1134725.4The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload end CVE-2026-113488.1Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affect CVE-2026-1134894.3The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing CVE-2026-113498.6The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and CVE-2026-1134905.3The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup throug CVE-2026-1134916.4The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when savi