Skip to contentWazuh vulnerabilities
Newest
- wazuhWazuh GitHub Actions Shell Injection via Fork Pull RequestCVE-2026-673089.3 Critical
- wazuhWazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master nodeCVE-2026-282208.4 High
- wazuhWazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent messageCVE-2026-442516.5 Medium
- wazuhWazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)CVE-2026-401064.7 Medium
- wazuhWazuh: Unauthenticated Path Traversal in authd via Agent Group NameCVE-2026-393597.5 High
- wazuhWazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsingCVE-2026-341507.5 High
- wazuhWazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)CVE-2026-337546.5 Medium
- wazuhWazuh: Rate Limit Bypass via /events EndpointCVE-2026-334344.3 Medium
- wazuhWazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()CVE-2026-414996.5 Medium
- wazuhWazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peerCVE-2026-308939.0 Critical
- wazuhWazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64CVE-2026-282216.5 Medium
- wazuhWazuh: API brute-force protection bypass via race condition in login attempt trackingCVE-2026-262066.5 Medium
- wazuhWazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDataCVE-2026-262044.4 Medium
- wazuh, wazuh provisioning scripts (agent build environment) +1 moreWazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCECVE-2025-156126.3 Medium
- wazuh, wazuh (github actions) +1 moreWazuh GitHub Actions Workflow Exposure of Sensitive CredentialsCVE-2025-15617Public exploit8.3 High
- wazuh, wazuh wazuh-agent, wazuh-manager +2 moreWazuh Agent and Manager OS Command Injection and Untrusted Search PathCVE-2025-156167.1 High
- wazuh, wazuh wazuh-manager +1 moreWazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of ServiceCVE-2025-156156.9 Medium
- wazuh, wazuh wazuh-manager +1 moreSSL/TLS Renegotiation DoS in Wazuh Manager authd serviceCVE-2026-329836.9 Medium
- wazuhWazuh authd service (os_auth) Heap-based Buffer OverflowCVE-2023-73405.3 Medium
- wazuhHeap buffer overflow in wazuh-authdCVE-2026-329845.3 Medium
- wazuhWazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON ParserCVE-2026-257904.9 Medium
- wazuhWazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer UnderflowCVE-2026-257724.9 Medium
- wazuhWazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication MiddlewareCVE-2026-257715.3 Medium
- wazuhWazuh has Privilege Escalation to Root via Cluster Protocol File WriteCVE-2026-257709.1 Critical
- wazuhWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationCVE-2026-25769Public exploit9.1 Critical
- wazuhWazuh NULL pointer dereference in fim_alert line 666CVE-2025-641695.1 Medium
- wazuhWazuh installation fails to protected authd.pass on WindowsCVE-2025-548661.8 Low
- wazuhWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration CapabilitiesCVE-2025-302017.7 High
- wazuh wazuh-dashboard-pluginsWazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment EndpointCVE-2025-644835.3 Medium
- wazuhWazuh vulnerable to Heap-based Buffer Over-read in w_expression_matchCVE-2025-627926.9 Medium
- wazuhWazuh vulnerable to NULL pointer dereference in DecodeCiscatCVE-2025-627916.9 Medium
- wazuhWazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_stateCVE-2025-627906.9 Medium
- wazuhWazuh vulnerable to NULL pointer dereference in fim_alert line 712CVE-2025-627896.9 Medium
- wazuhWazuh Vulnerable to Heap Use After Free in w_copy_event_for_logCVE-2025-627886.3 Medium
- wazuhWazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevtCVE-2025-627872.1 Low
- wazuhWazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissionsCVE-2025-627866.3 Medium
- wazuhWazuh fillData NULL pointer dereference causes analysisd crashCVE-2025-627856.9 Medium
- wazuhHeap buffer overflow in wazuh-analysisdCVE-2025-599386.5 Medium
- wazuh, wazuh agent +1 moreRemote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theftCVE-2024-12439.5 Critical
- wazuh, wazuh server +1 moreRemote code execution in Wazuh serverCVE-2025-24016In KEVPublic exploitFix availableEPSS 93.8%9.9 Critical
- wazuhImproper Access Control in wazuh-agentCVE-2024-35177Fix available7.8 High
- wazuhAbility to view Agent list with no privilege access in wazuh-dashboardCVE-2024-47770Fix available4.6 Medium
- wazuh, wazuh manager +1 moreWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2024-320389.8 Critical
- wazuhWazuh's vulnerability in host_deny AR script allows arbitrary command executionCVE-2023-50260EPSS 41.2%8.8 High
- wazuhWazuh vulnerable to NULL Pointer Dereference in wazuh-analysisdCVE-2023-492756.5 Medium
- wazuhwazuh-logcollector integer underflow local privilege escalationCVE-2023-424637.4 High
- wazuh wazuh-dashboard, wazuh-kibana-app +1 moreWazuh vulnerable to user privilege escalationCVE-2023-424558.8 High
- wazuhWazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an...CVE-2022-404978.8 High
- wazuhIn the wazuh-slack active response script in Wazuh before 4.2.5, untrusted user agents are passed...CVE-2021-440799.8 Critical
- wazuhWazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that...CVE-2021-418216.5 Medium
- Show moreLoading…