WA
Product
wazuh-manager
21
CVEs
0
On KEV
9.1
Max CVSS
14
New 30D
Severity mix
Critical 2High 9Medium 10Low 0
Watch
Add wazuh-manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-74040 | 9.1 | Oct 13 | Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker Affected: 3.9.0 before 4.14.8 |
| CVE-2026-74043 | 9.0 | Oct 13 | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions Affected: 4.1.1 before 4.14.8 |
| CVE-2026-74034 | 7.5 | Oct 13 | Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command Affected: 4.1.0 before 4.14.8 |
| CVE-2025-15615 | 7.5 | Mar 27 | Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service Affected: <= 4.7.3; <= 4.7.3 |
| CVE-2026-32983 | 7.5 | Mar 27 | SSL/TLS Renegotiation DoS in Wazuh Manager authd service Affected: through 4.7.3 |
| CVE-2026-74041 | 7.2 | Oct 13 | Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch Affected: 4.14.3 before 4.14.8; 4.10.4 before 4.10.5 |
| CVE-2026-74037 | 7.2 | Oct 13 | Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token Affected: 4.0.0 before 4.14.8 |
| CVE-2026-74035 | 7.2 | Oct 13 | Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user Affected: 4.6.0 before 4.14.8 |
| CVE-2025-15616 | 7.2 | Mar 27 | Wazuh Agent and Manager OS Command Injection and Untrusted Search Path Affected: 2.1.0 before 4.8.0 |
| CVE-2026-74045 | 7.1 | Oct 13 | Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder Affected: 3.12.0 before 4.14.8 |
| CVE-2026-74038 | 7.1 | Aug 18 | Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment Affected: 4.0.0 before 4.14.6 |
| CVE-2026-74047 | 6.5 | Oct 13 | Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint Affected: 4.0.0 before 4.14.8 |
| CVE-2026-74031 | 6.5 | Oct 13 | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers Affected: 4.1.1 before 4.14.8 |
| CVE-2026-74044 | 6.5 | Aug 18 | Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello Affected: 4.0.0 before 4.14.6 |
| CVE-2026-74039 | 6.5 | Aug 18 | Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context Affected: 4.0.0 before 4.14.7; 5.0.0-beta2 |
| CVE-2026-74033 | 6.1 | Oct 13 | Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers Affected: 4.1.1 before 4.14.8 |
| CVE-2026-93346 | 5.3 | Oct 13 | Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition Affected: 4.0.0 before 4.14.8 |
| CVE-2026-93347 | 4.9 | Oct 13 | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file Affected: 4.1.1 before 4.14.8 |
| CVE-2026-74030 | 4.9 | Oct 13 | Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion Affected: 3.9.0 before 4.14.8 |
| CVE-2026-74046 | 4.9 | Aug 18 | Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb Affected: 4.4.0 before 4.14.7 |
| CVE-2026-74032 | 4.3 | Oct 13 | Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions Affected: 4.0.0 before 4.14.8 |
Showing 21