Skip to contentWazuh Wazuh vulnerabilities
- wazuhWazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_paramsCVE-2026-1123417.1 High
- wazuh wazuh-dashboard-pluginsWazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/requestCVE-2026-1123408.8 High
- wazuhWazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward ModuleCVE-2026-1123398.2 High
- wazuhWazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link PaginationCVE-2026-1123388.2 High
- wazuhWazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink PaginationCVE-2026-1123376.3 Medium
- wazuhWazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON DecoderCVE-2026-1123367.1 High
- wazuhWazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfullCVE-2026-1123356.8 Medium
- wazuhWazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.confCVE-2026-1123346.9 Medium
- wazuhWazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XMLCVE-2026-623655.3 Medium
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_fileCVE-2026-933476.9 Medium
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race ConditionCVE-2026-933466.9 Medium
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config EndpointCVE-2026-740477.1 High
- wazuh wazuh-managerWazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM DecoderCVE-2026-740457.1 High
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload FunctionsCVE-2026-740438.5 High
- wazuh wazuh-managerWazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case MismatchCVE-2026-740418.6 High
- wazuh wazuh-managerWazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_workerCVE-2026-740409.4 Critical
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenCVE-2026-740378.6 High
- wazuh wazuh-agentWazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command PoliciesCVE-2026-740368.6 High
- wazuh wazuh-managerWazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_userCVE-2026-740358.6 High
- wazuh wazuh-managerWazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom CommandCVE-2026-74034Public exploit8.7 High
- wazuh wazuh-managerWazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster HandlersCVE-2026-740338.4 High
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actionsCVE-2026-740325.3 Medium
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete HelpersCVE-2026-740317.0 High
- wazuh wazuh-agent, wazuh-manager +1 moreWazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias ExpansionCVE-2026-740306.9 Medium
- wazuhWazuh Manager cluster header parsing allows pre-authentication memory exhaustionCVE-2026-715407.5 High
- wazuhWazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack ExhaustionCVE-2026-618116.5 Medium
- wazuhWazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/configCVE-2026-618026.5 Medium
- wazuhWazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)CVE-2026-618009.1 Critical
- wazuhWazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.keyCVE-2026-617837.0 High
- wazuhWazuh agent enrollment NULL pointer dereference via malformed manager responseCVE-2026-540845.3 Medium
- wazuhWazuh: Missing input validation in multiple active response scripts allows argument injectionCVE-2026-540857.1 High
- wazuhWazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletionCVE-2026-540838.1 High
- wazuhWazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckdCVE-2026-493925.3 Medium
- wazuhWazuh: CRLF Log Injection via Unsanitized Basic-Auth UsernameCVE-2026-442565.3 Medium
- wazuhWazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: fieldCVE-2026-457987.5 High
- wazuhWazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh managerCVE-2026-494419.1 Critical
- wazuhWazuh: Privilege Escalation via Admin-Protection Bypass in update-user API EndpointCVE-2026-414248.2 High
- wazuhWazuh: Username Enumeration via Timing Side-ChannelCVE-2026-442555.3 Medium
- wazuhWazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh managerCVE-2026-480249.1 Critical
- wazuhWazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh managerCVE-2026-481629.1 Critical
- wazuhWazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2026-449018.4 High
- wazuhWazuh: Stack Out-of-Bounds Write in remoted Decompression PathCVE-2026-442545.3 Medium
- wazuhWazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()CVE-2026-463437.5 High
- wazuhWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationCVE-2026-442534.9 Medium
- wazuhWazuh Manager dapi RBAC Bypass Allows Privilege EscalationCVE-2026-442527.7 High
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip BombCVE-2026-740466.9 Medium
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster HelloCVE-2026-740447.0 High
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextCVE-2026-740397.1 High
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent EnrollmentCVE-2026-740387.0 High
- wazuhWazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory SyncCVE-2026-673077.0 High
- Show olderLoading…