Login Request a demo
WA
Vendor
wazuh
8 products with CVEs on record
105
CVEs
2
On KEV
16
New 30D
Products
WA
wazuh-manager
Wazuh
9.1
21 CVEs0 on KEV14 new
WA
wazuh-agent
Wazuh
7.2
3 CVEs0 on KEV2 new
WA
wazuh
wazuh
9.9
76 CVEs1 on KEV0 new
WS
Wazuh Server
Wazuh
9.9
1 CVEs1 on KEV0 new
WA
Wazuh-dashboard
Wazuh
8.8
1 CVEs0 on KEV0 new
WG
Wazuh (GitHub Actions)
Wazuh
8.1
1 CVEs0 on KEV0 new
WA
Wazuh-kibana-app
Wazuh
8.8
1 CVEs0 on KEV0 new
WP
Wazuh Provisioning Scripts (Agent Build Environment)
Wazuh
8.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-93347
WA
wazuh-manager
Wazuh
4.9
0%
Oct 13Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
CVE-2026-93346
WA
wazuh-manager
Wazuh
5.3
0%
Oct 13Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
CVE-2026-74047
WA
wazuh-manager
Wazuh
6.5
0%
Oct 13Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
CVE-2026-74045
WA
wazuh-manager
Wazuh
7.1
0%
Oct 13Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
CVE-2026-74043
WA
wazuh-manager
Wazuh
9.0
0%
Oct 13Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
CVE-2026-74041
WA
wazuh-manager
Wazuh
7.2
0%
Oct 13Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
CVE-2026-74040
WA
wazuh-manager
Wazuh
9.1
1%
Oct 13Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
CVE-2026-74037
WA
wazuh-manager
Wazuh
7.2
0%
Oct 13Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE-2026-74036
WA
wazuh-agent
Wazuh
7.2
1%
Oct 13Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
CVE-2026-74035
WA
wazuh-manager
Wazuh
7.2
1%
Oct 13Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
CVE-2026-74034
WA
wazuh-manager
Wazuh
7.5
0%
Oct 13Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
CVE-2026-74033
WA
wazuh-manager
Wazuh
6.1
0%
Oct 13Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
CVE-2026-74032
WA
wazuh-manager
Wazuh
4.3
0%
Oct 13Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
CVE-2026-74031
WA
wazuh-manager
Wazuh
6.5
1%
Oct 13Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
CVE-2026-74030
WA
wazuh-manager
Wazuh
4.9
0%
Oct 13Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
CVE-2026-71540
WA
wazuh
wazuh
7.5
0%
Sep 24Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
CVE-2026-61811
WA
wazuh
wazuh
6.5
0%
Sep 24Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
CVE-2026-61802
WA
wazuh
wazuh
6.5
1%
Aug 27Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
CVE-2026-61800
WA
wazuh
wazuh
9.1
1%
Aug 27Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
CVE-2026-61783
WA
wazuh
wazuh
6.5
0%
Aug 27Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
CVE-2026-54084
WA
wazuh
wazuh
5.3
0%
Aug 27Wazuh agent enrollment NULL pointer dereference via malformed manager response
CVE-2026-54085
WA
wazuh
wazuh
7.1
0%
Aug 27Wazuh: Missing input validation in multiple active response scripts allows argument injection
CVE-2026-54083
WA
wazuh
wazuh
8.1
1%
Aug 27Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
CVE-2026-49392
WA
wazuh
wazuh
5.3
0%
Aug 19Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
CVE-2026-44256
WA
wazuh
wazuh
5.3
0%
Aug 19Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
CVE-2026-45798
WA
wazuh
wazuh
7.5
1%
Aug 19Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field
CVE-2026-49441
WA
wazuh
wazuh
9.1
1%
Aug 19Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
CVE-2026-41424
WA
wazuh
wazuh
8.2
0%
Aug 19Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint
CVE-2026-44255
WA
wazuh
wazuh
5.3
1%
Aug 19Wazuh: Username Enumeration via Timing Side-Channel
CVE-2026-48024
WA
wazuh
wazuh
9.1
1%
Aug 19Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager
CVE-2026-48162
WA
wazuh
wazuh
9.1
1%
Aug 19Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager
CVE-2026-44901
WA
wazuh
wazuh
8.4
1%
Aug 19Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVE-2026-44254
WA
wazuh
wazuh
5.3
0%
Aug 19Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
CVE-2026-46343
WA
wazuh
wazuh
7.2
0%
Aug 19Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
CVE-2026-44253
WA
wazuh
wazuh
4.9
1%
Aug 19Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
CVE-2026-44252
WA
wazuh
wazuh
8.8
1%
Aug 19Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
CVE-2026-74046
WA
wazuh-manager
Wazuh
4.9
1%
Aug 18Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
CVE-2026-74044
WA
wazuh-manager
Wazuh
6.5
1%
Aug 18Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
CVE-2026-74039
WA
wazuh-manager
Wazuh
6.5
1%
Aug 18Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
CVE-2026-74038
WA
wazuh-manager
Wazuh
7.1
1%
Aug 18Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
CVE-2026-67307
WA
wazuh
wazuh
7.7
0%
Aug 1Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
CVE-2026-67308
WA
wazuh
wazuh
9.3
1%
Aug 1Wazuh GitHub Actions Shell Injection via Fork Pull Request
CVE-2026-28220
WA
wazuh
wazuh
9.1
1%
Jul 20Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node
CVE-2026-44251
WA
wazuh
wazuh
6.5
0%
Jul 17Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message
CVE-2026-40106
WA
wazuh
wazuh
7.8
0%
Jul 16Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)
CVE-2026-39359
WA
wazuh
wazuh
7.5
0%
Jul 16Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name
CVE-2026-34150
WA
wazuh
wazuh
7.5
0%
Jul 16Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing
CVE-2026-33754
WA
wazuh
wazuh
6.5
0%
Jul 16Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)
CVE-2026-33434
WA
wazuh
wazuh
7.1
0%
Jul 16Wazuh: Rate Limit Bypass via /events Endpoint
CVE-2026-41499
WA
wazuh
wazuh
6.5
0%
Apr 29Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()
CVE-2026-30893
WA
wazuh
wazuh
9.9
0%
Apr 29Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
CVE-2026-28221
WA
wazuh
wazuh
8.2
0%
Apr 29Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64
CVE-2026-26206
WA
wazuh
wazuh
6.5
0%
Apr 29Wazuh: API brute-force protection bypass via race condition in login attempt tracking
CVE-2026-26204
WA
wazuh
wazuh
5.5
0%
Apr 29Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData
CVE-2025-15612
WP
Wazuh Provisioning Scripts (Agent Build Environment)
Wazuh
8.1
0%
Mar 27Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
CVE-2025-15617
WG
Wazuh (GitHub Actions)
Wazuh
8.1
0%
Mar 27Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials
CVE-2025-15616
WA
wazuh-agent
Wazuh
7.2
2%
Mar 27Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
CVE-2025-15615
WA
wazuh-manager
Wazuh
7.5
1%
Mar 27Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service
CVE-2023-7340
WA
Wazuh
Wazuh
4.3
0%
Mar 27Wazuh authd service (os_auth) Heap-based Buffer Overflow
CVE-2026-32983
WA
wazuh-manager
Wazuh
7.5
0%
Mar 27SSL/TLS Renegotiation DoS in Wazuh Manager authd service