Wazuh vulnerabilities

Products

• Wazuh 84
• Wazuh-manager 21
• Wazuh-agent 3
• Wazuh-dashboard-plugins 2

Newest

• wazuh Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params CVE-2026-112341 7.1 HighNovember 6, 2026
• wazuh wazuh-dashboard-plugins Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request CVE-2026-112340 8.8 HighNovember 6, 2026
• wazuh Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module CVE-2026-112339 8.2 HighNovember 6, 2026
• wazuh Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination CVE-2026-112338 8.2 HighNovember 6, 2026
• wazuh Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination CVE-2026-112337 6.3 MediumNovember 6, 2026
• wazuh Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder CVE-2026-112336 7.1 HighNovember 6, 2026
• wazuh Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull CVE-2026-112335 6.8 MediumNovember 6, 2026
• wazuh Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf CVE-2026-112334 6.9 MediumNovember 6, 2026
• wazuh Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML CVE-2026-62365 5.3 MediumNovember 4, 2026
• wazuh wazuh-manager Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file CVE-2026-93347 6.9 MediumOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition CVE-2026-93346 6.9 MediumOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint CVE-2026-74047 7.1 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder CVE-2026-74045 7.1 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions CVE-2026-74043 8.5 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch CVE-2026-74041 8.6 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker CVE-2026-74040 9.4 CriticalOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token CVE-2026-74037 8.6 HighOctober 13, 2026
• wazuh wazuh-agent Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies CVE-2026-74036 8.6 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user CVE-2026-74035 8.6 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command CVE-2026-74034 Public exploit 8.7 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers CVE-2026-74033 8.4 HighOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions CVE-2026-74032 5.3 MediumOctober 13, 2026
• wazuh wazuh-manager Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers CVE-2026-74031 7.0 HighOctober 13, 2026
• wazuh wazuh-agent, wazuh-manager +1 more Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion CVE-2026-74030 6.9 MediumOctober 13, 2026
• wazuh Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion CVE-2026-71540 7.5 HighSeptember 24, 2026
• wazuh Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion CVE-2026-61811 6.5 MediumSeptember 24, 2026
• wazuh Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config CVE-2026-61802 6.5 MediumAugust 27, 2026
• wazuh Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) CVE-2026-61800 9.1 CriticalAugust 27, 2026
• wazuh Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key CVE-2026-61783 7.0 HighAugust 27, 2026
• wazuh Wazuh agent enrollment NULL pointer dereference via malformed manager response CVE-2026-54084 5.3 MediumAugust 27, 2026
• wazuh Wazuh: Missing input validation in multiple active response scripts allows argument injection CVE-2026-54085 7.1 HighAugust 27, 2026
• wazuh Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion CVE-2026-54083 8.1 HighAugust 27, 2026
• wazuh Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd CVE-2026-49392 5.3 MediumAugust 19, 2026
• wazuh Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username CVE-2026-44256 5.3 MediumAugust 19, 2026
• wazuh Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field CVE-2026-45798 7.5 HighAugust 19, 2026
• wazuh Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager CVE-2026-49441 9.1 CriticalAugust 19, 2026
• wazuh Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint CVE-2026-41424 8.2 HighAugust 19, 2026
• wazuh Wazuh: Username Enumeration via Timing Side-Channel CVE-2026-44255 5.3 MediumAugust 19, 2026
• wazuh Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager CVE-2026-48024 9.1 CriticalAugust 19, 2026
• wazuh Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager CVE-2026-48162 9.1 CriticalAugust 19, 2026
• wazuh Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2026-44901 8.4 HighAugust 19, 2026
• wazuh Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path CVE-2026-44254 5.3 MediumAugust 19, 2026
• wazuh Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file() CVE-2026-46343 7.5 HighAugust 19, 2026
• wazuh Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation CVE-2026-44253 4.9 MediumAugust 19, 2026
• wazuh Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation CVE-2026-44252 7.7 HighAugust 19, 2026
• wazuh, wazuh wazuh-manager +1 more Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb CVE-2026-74046 6.9 MediumAugust 18, 2026
• wazuh, wazuh wazuh-manager +1 more Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello CVE-2026-74044 7.0 HighAugust 18, 2026
• wazuh, wazuh wazuh-manager +1 more Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context CVE-2026-74039 7.1 HighAugust 18, 2026
• wazuh, wazuh wazuh-manager +1 more Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment CVE-2026-74038 7.0 HighAugust 18, 2026
• wazuh Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync CVE-2026-67307 7.0 HighAugust 1, 2026
• Show olderLoading…