WA
Product
wazuh
On CISA KEVExploited in the wild
76
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 40Medium 23Low 1
Watch
Add wazuh to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24016 In wildKEV | 9.9 | Feb 10 | Remote code execution in Wazuh server Affected: >= 4.4.0, < 4.9.1 |
| CVE-2026-30893 | 9.9 | Apr 29 | Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer Affected: >= 4.4.0, < 4.14.4 |
| CVE-2024-32038 | 9.8 | Apr 19 | Wazuh is a free and open source platform used for threat prevention, detection, and response Affected: 3.8.0 before 4.7.2 |
| CVE-2021-44079 | 9.8 | Nov 22 | In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution Affected: 4.2.0 before 4.2.5 |
| CVE-2026-67308 | 9.3 | Aug 1 | Wazuh GitHub Actions Shell Injection via Fork Pull Request Affected: before 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 |
| CVE-2026-61800 | 9.1 | Aug 27 | Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) Affected: >= 4.4.0, < 4.14.7 |
| CVE-2026-49441 | 9.1 | Aug 19 | Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager Affected: >= 4.3.0, < 4.14.6; >= 5.0.0-beta1, < 5.0.0-beta3 |
| CVE-2026-48024 | 9.1 | Aug 19 | Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager Affected: >= 4.0.0, < 4.14.6; >= 5.0.0-beta1, < 5.0.0-beta3 |
| CVE-2026-48162 | 9.1 | Aug 19 | Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager Affected: >= 4.0.0, < 4.14.6; >= 5.0.0-beta1, < 5.0.0-beta3 |
| CVE-2026-28220 | 9.1 | Jul 20 | Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node Affected: >= 4.0.0, < 4.14.5 |
| CVE-2026-25769 | 9.1 | Mar 17 | Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization Affected: >= 4.0.0, < 4.14.3 |
| CVE-2025-30201 | 9.1 | Nov 21 | Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities Affected: < 4.13.0 |
Showing 12