94 matches found
Malicious code in checkmate-remediation-assistant (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4 The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, the home...
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...
EUVD-2026-70667
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
PT-2026-85223
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-85390: Missing Authorization
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...
PT-2026-82660
Name of the Vulnerable Software and Affected Versions Bluewave Labs Checkmate versions prior to 3.3.1 Description An issue in the inviteController.js component allows remote authenticated administrators to escalate their privileges to superadmin. This is achieved by manipulating the role paramete...
EUVD-2026-67253
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...
CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...
CVE-2026-36102
Bluewave Labs Checkmate version
CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...
CVE-2026-36102: Improper Privilege Management
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...
CVE-2026-71862
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...
CVE-2026-70656
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...
CVE-2026-55241
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...
CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...