WWazuh

Products

Exploited and recent CVEs

• CVE-2025-24016 Critical 9.9 Exploited Remote code execution in Wazuh server 93.8%
• CVE-2026-62365 Medium 5.3 Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML 0.3%
• CVE-2026-93347 Medium 4.9 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file 0.4%
• CVE-2026-93346 Medium 5.3 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition 0.3%
• CVE-2026-74047 Medium 6.5 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint 0.3%
• CVE-2026-74045 High 7.1 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder 0.3%
• CVE-2026-74043 Critical 9.0 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions 0.4%
• CVE-2026-74041 High 7.2 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch 0.5%
• CVE-2026-74040 Critical 9.1 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 0.7%
• CVE-2026-74037 High 7.2 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token 0.5%
• CVE-2026-74036 High 7.2 Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies 0.8%
• CVE-2026-74035 High 7.2 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user 0.6%
• CVE-2026-74034 High 7.5 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command 0.4%
• CVE-2026-74033 Medium 6.1 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers 0.3%
• CVE-2026-74032 Medium 4.3 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions 0.3%
• CVE-2026-74031 Medium 6.5 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers 0.5%
• CVE-2026-74030 Medium 4.9 Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion 0.4%
• CVE-2026-74030 Medium 4.9 Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion 0.4%
• CVE-2026-71540 High 7.5 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion 0.4%
• CVE-2026-61811 Medium 6.5 Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion 0.4%
• CVE-2026-61802 Medium 6.5 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config 0.7%
• CVE-2026-61800 Critical 9.1 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) 1.0%
• CVE-2026-61783 High 7.0 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key 0.4%
• CVE-2026-54084 Medium 5.3 Wazuh agent enrollment NULL pointer dereference via malformed manager response 0.2%
• CVE-2026-54085 High 7.1 Wazuh: Missing input validation in multiple active response scripts allows argument injection 0.4%
• CVE-2026-54083 High 8.1 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion 0.6%
• CVE-2026-49392 Medium 5.3 Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd 0.3%
• CVE-2026-44256 Medium 5.3 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username 0.5%
• CVE-2026-45798 High 7.5 Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field 0.9%
• CVE-2026-49441 Critical 9.1 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager 0.8%