CVE-2026-20915

MediumCVSS 5.4/10Last modified Jul 25, 2026

Description

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-209168.1An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint o CVE-2026-209174.0Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0:CVE-2026-209187.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-209197.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attac CVE-2026-20927.7A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted asse CVE-2026-209207.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-209217.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attac CVE-2026-209227.8Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.CVE-2026-209237.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-209247.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-209256.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2026-209267.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attac