CWE-140

Improper Neutralization of Delimiters

9 CVEs Avg CVSS 6.1 MITRE
0
CRITICAL
2
HIGH
7
MEDIUM
0
LOW
1
POC
0
KEV

Monthly

CVE-2026-33457 MEDIUM This Month

Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient input sanitization. Affected versions include Checkmk 2.3.0 before p47, 2.4.0 before p26, and 2.5.0 before b4. The vulnerability requires valid authentication credentials to exploit and results in limited confidentiality, integrity, and availability impact within the Livestatus subsystem.

Code Injection Checkmk
NVD VulDB
CVSS 4.0
5.3
EPSS
0.0%
CVE-2026-33456 MEDIUM This Month

Livestatus injection in Checkmk's notification test mode allows authenticated users with high privileges to inject arbitrary Livestatus commands via crafted service descriptions in versions prior to 2.5.0b4 and 2.4.0p26. The vulnerability has a CVSS score of 5.1 with limited confidentiality and integrity impact, requiring high-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.

Code Injection Checkmk
NVD VulDB
CVSS 4.0
5.1
EPSS
0.0%
CVE-2026-33455 MEDIUM This Month

Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in versions prior to 2.5.0b4. The vulnerability requires valid authentication credentials and enables low-impact information disclosure and limited integrity/availability changes within the monitoring system. No public exploit code or active exploitation has been reported at time of analysis.

Code Injection Checkmk
NVD VulDB
CVSS 4.0
5.3
EPSS
0.0%
CVE-2025-52989 MEDIUM This Month

A security vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local (CVSS 5.1). Remediation should follow standard vulnerability management procedures.

Information Disclosure Juniper Junos Junos Os Evolved
NVD
CVSS 3.1
5.1
EPSS
0.0%
CVE-2025-32918 HIGH PATCH This Week

A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated user. High severity vulnerability requiring prompt remediation.

Code Injection Ubuntu Debian Checkmk
NVD
CVSS 3.1
8.8
EPSS
0.1%
CVE-2025-48879 MEDIUM PATCH This Month

A security vulnerability in OctoPrint versions up until and including 1.11.1 contain a vulnerability that (CVSS 6.5) that allows any unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Information Disclosure Debian Octoprint
NVD GitHub
CVSS 3.1
6.5
EPSS
0.0%
CVE-2024-38866 MEDIUM PATCH This Month

Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.

Code Injection Nagvis
NVD GitHub
CVSS 4.0
5.3
EPSS
0.3%
CVE-2025-47779 HIGH POC This Month

Asterisk is an open-source private branch exchange (PBX). Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Microsoft Information Disclosure Asterisk Certified Asterisk
NVD GitHub
CVSS 3.1
7.7
EPSS
0.3%
CVE-2024-38865 MEDIUM This Month

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Checkmk
NVD
CVSS 4.0
6.0
EPSS
0.8%
CVE-2026-33457
EPSS 0% CVSS 5.3
MEDIUM This Month

Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient input sanitization. Affected versions include Checkmk 2.3.0 before p47, 2.4.0 before p26, and 2.5.0 before b4. The vulnerability requires valid authentication credentials to exploit and results in limited confidentiality, integrity, and availability impact within the Livestatus subsystem.

Code Injection Checkmk
NVD VulDB
CVE-2026-33456
EPSS 0% CVSS 5.1
MEDIUM This Month

Livestatus injection in Checkmk's notification test mode allows authenticated users with high privileges to inject arbitrary Livestatus commands via crafted service descriptions in versions prior to 2.5.0b4 and 2.4.0p26. The vulnerability has a CVSS score of 5.1 with limited confidentiality and integrity impact, requiring high-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.

Code Injection Checkmk
NVD VulDB
CVE-2026-33455
EPSS 0% CVSS 5.3
MEDIUM This Month

Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in versions prior to 2.5.0b4. The vulnerability requires valid authentication credentials and enables low-impact information disclosure and limited integrity/availability changes within the monitoring system. No public exploit code or active exploitation has been reported at time of analysis.

Code Injection Checkmk
NVD VulDB
CVE-2025-52989
EPSS 0% CVSS 5.1
MEDIUM This Month

A security vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local (CVSS 5.1). Remediation should follow standard vulnerability management procedures.

Information Disclosure Juniper Junos +1
NVD
CVE-2025-32918
EPSS 0% CVSS 8.8
HIGH PATCH This Week

A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated user. High severity vulnerability requiring prompt remediation.

Code Injection Ubuntu Debian +1
NVD
CVE-2025-48879
EPSS 0% CVSS 6.5
MEDIUM PATCH This Month

A security vulnerability in OctoPrint versions up until and including 1.11.1 contain a vulnerability that (CVSS 6.5) that allows any unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Information Disclosure Debian Octoprint
NVD GitHub
CVE-2024-38866
EPSS 0% CVSS 5.3
MEDIUM PATCH This Month

Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.

Code Injection Nagvis
NVD GitHub
CVE-2025-47779
EPSS 0% CVSS 7.7
HIGH POC This Month

Asterisk is an open-source private branch exchange (PBX). Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Microsoft Information Disclosure Asterisk +1
NVD GitHub
CVE-2024-38865
EPSS 1% CVSS 6.0
MEDIUM This Month

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Checkmk
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy