Wazuh vulnerabilities
97 CVEs and advisories name Wazuh as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-112341Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
- CVE-2026-112340Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
- CVE-2026-112339Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
- CVE-2026-112338Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
- CVE-2026-112337Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination
- CVE-2026-112336Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
- CVE-2026-112335Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
- CVE-2026-112334Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
- CVE-2026-62365Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML
- CVE-2026-93347Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
- CVE-2026-93346Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
- CVE-2026-74047Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
- CVE-2026-74045Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
- CVE-2026-74043Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
- CVE-2026-74041Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
- CVE-2026-74040Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
- CVE-2026-74037Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
- CVE-2026-74036Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
- CVE-2026-74035Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
- CVE-2026-74034Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
- CVE-2026-74033Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
- CVE-2026-74032Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
- CVE-2026-74031Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
- CVE-2026-74030Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
- CVE-2026-71540Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
- CVE-2026-61811Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
- CVE-2026-61802Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
- CVE-2026-61800Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
- CVE-2026-61783Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
- CVE-2026-54084Wazuh agent enrollment NULL pointer dereference via malformed manager response