# cve.now: Wazuh

The newest entries naming Wazuh as an affected vendor (up to 200), of 97 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112341](https://cve.now/CVE-2026-112341.md): Wazuh before 4.14.9 SQL Injection via WazuhDBBackend \_substitute\_params (CVSS 7.1)
- [CVE-2026-112340](https://cve.now/CVE-2026-112340.md): Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request (CVSS 8.8)
- [CVE-2026-112339](https://cve.now/CVE-2026-112339.md): Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module (CVSS 8.2)
- [CVE-2026-112338](https://cve.now/CVE-2026-112338.md): Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination (CVSS 8.2)
- [CVE-2026-112337](https://cve.now/CVE-2026-112337.md): Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination (CVSS 6.3)
- [CVE-2026-112336](https://cve.now/CVE-2026-112336.md): Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder (CVSS 7.1)
- [CVE-2026-112335](https://cve.now/CVE-2026-112335.md): Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read\_snortfull (CVSS 6.8)
- [CVE-2026-112334](https://cve.now/CVE-2026-112334.md): Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf (CVSS 6.9)
- [CVE-2026-62365](https://cve.now/CVE-2026-62365.md): Wazuh: Heap Buffer Overflow in DecodeWinevt() join\_data Accumulation via Crafted EventChannel XML (CVSS 5.3)
- [CVE-2026-93347](https://cve.now/CVE-2026-93347.md): Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get\_list\_file (CVSS 6.9)
- [CVE-2026-93346](https://cve.now/CVE-2026-93346.md): Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition (CVSS 6.9)
- [CVE-2026-74047](https://cve.now/CVE-2026-74047.md): Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint (CVSS 7.1)
- [CVE-2026-74045](https://cve.now/CVE-2026-74045.md): Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder (CVSS 7.1)
- [CVE-2026-74043](https://cve.now/CVE-2026-74043.md): Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions (CVSS 8.5)
- [CVE-2026-74041](https://cve.now/CVE-2026-74041.md): Wazuh 4.14.3 \< 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch (CVSS 8.6)
- [CVE-2026-74040](https://cve.now/CVE-2026-74040.md): Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process\_files\_from\_worker (CVSS 9.4)
- [CVE-2026-74037](https://cve.now/CVE-2026-74037.md): Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check\_token (CVSS 8.6)
- [CVE-2026-74036](https://cve.now/CVE-2026-74036.md): Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies (CVSS 8.6)
- [CVE-2026-74035](https://cve.now/CVE-2026-74035.md): Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update\_user (CVSS 8.6)
- [CVE-2026-74034](https://cve.now/CVE-2026-74034.md): Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade\_custom Command (CVSS 8.7)
- [CVE-2026-74033](https://cve.now/CVE-2026-74033.md): Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers (CVSS 8.4)
- [CVE-2026-74032](https://cve.now/CVE-2026-74032.md): Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions (CVSS 5.3)
- [CVE-2026-74031](https://cve.now/CVE-2026-74031.md): Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers (CVSS 7.0)
- [CVE-2026-74030](https://cve.now/CVE-2026-74030.md): Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion (CVSS 6.9)
- [CVE-2026-71540](https://cve.now/CVE-2026-71540.md): Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion (CVSS 7.5)
- [CVE-2026-61811](https://cve.now/CVE-2026-61811.md): Wazuh: Unbounded Recursion in os\_xml \`\_getattributes()\` Causes analysisd Worker Thread Stack Exhaustion (CVSS 6.5)
- [CVE-2026-61802](https://cve.now/CVE-2026-61802.md): Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config (CVSS 6.5)
- [CVE-2026-61800](https://cve.now/CVE-2026-61800.md): Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) (CVSS 9.1)
- [CVE-2026-61783](https://cve.now/CVE-2026-61783.md): Wazuh: RBAC permission-effect check in mask\_sensitive\_config allows low-privilege users to read cluster.key (CVSS 7.0)
- [CVE-2026-54084](https://cve.now/CVE-2026-54084.md): Wazuh agent enrollment NULL pointer dereference via malformed manager response (CVSS 5.3)
- [CVE-2026-54085](https://cve.now/CVE-2026-54085.md): Wazuh: Missing input validation in multiple active response scripts allows argument injection (CVSS 7.1)
- [CVE-2026-54083](https://cve.now/CVE-2026-54083.md): Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion (CVSS 8.1)
- [CVE-2026-49392](https://cve.now/CVE-2026-49392.md): Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd (CVSS 5.3)
- [CVE-2026-44256](https://cve.now/CVE-2026-44256.md): Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username (CVSS 5.3)
- [CVE-2026-45798](https://cve.now/CVE-2026-45798.md): Wazuh: Pre-auth stack-buffer-overflow in compare\_wazuh\_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field (CVSS 7.5)
- [CVE-2026-49441](https://cve.now/CVE-2026-49441.md): Wazuh : peer-controlled metadata key in process\_files\_from\_worker non-merged branch allows arbitrary file write under WAZUH\_PATH on Wazuh manager (CVSS 9.1)
- [CVE-2026-41424](https://cve.now/CVE-2026-41424.md): Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint (CVSS 8.2)
- [CVE-2026-44255](https://cve.now/CVE-2026-44255.md): Wazuh: Username Enumeration via Timing Side-Channel (CVSS 5.3)
- [CVE-2026-48024](https://cve.now/CVE-2026-48024.md): Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH\_PATH in Wazuh manager (CVSS 9.1)
- [CVE-2026-48162](https://cve.now/CVE-2026-48162.md): Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp\_file path injection in Wazuh manager (CVSS 9.1)
- [CVE-2026-44901](https://cve.now/CVE-2026-44901.md): Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.4)
- [CVE-2026-44254](https://cve.now/CVE-2026-44254.md): Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path (CVSS 5.3)
- [CVE-2026-46343](https://cve.now/CVE-2026-46343.md): Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end\_receiving\_file() (CVSS 7.5)
- [CVE-2026-44253](https://cve.now/CVE-2026-44253.md): Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive\_str allocation and div\_msg\_box accumulation (CVSS 4.9)
- [CVE-2026-44252](https://cve.now/CVE-2026-44252.md): Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation (CVSS 7.7)
- [CVE-2026-74046](https://cve.now/CVE-2026-74046.md): Wazuh 4.4.0 \< 4.14.7 DoS via fdecompress\_files() Zip Bomb (CVSS 6.9)
- [CVE-2026-74044](https://cve.now/CVE-2026-74044.md): Wazuh 4.0.0 \< 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello (CVSS 7.0)
- [CVE-2026-74039](https://cve.now/CVE-2026-74039.md): Wazuh 4.0.0 \< 4.14.7 API DoS via Deeply Nested JSON auth\_context (CVSS 7.1)
- [CVE-2026-74038](https://cve.now/CVE-2026-74038.md): Wazuh 4.0.0 \< 4.14.6 Path Traversal DoS via Agent Enrollment (CVSS 7.0)
- [CVE-2026-67307](https://cve.now/CVE-2026-67307.md): Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync (CVSS 7.0)
- [CVE-2026-67308](https://cve.now/CVE-2026-67308.md): Wazuh GitHub Actions Shell Injection via Fork Pull Request (CVSS 9.3)
- [CVE-2026-28220](https://cve.now/CVE-2026-28220.md): Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node (CVSS 8.4)
- [CVE-2026-44251](https://cve.now/CVE-2026-44251.md): Wazuh : size\_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message (CVSS 6.5)
- [CVE-2026-40106](https://cve.now/CVE-2026-40106.md): Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS) (CVSS 4.7)
- [CVE-2026-39359](https://cve.now/CVE-2026-39359.md): Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name (CVSS 7.5)
- [CVE-2026-34150](https://cve.now/CVE-2026-34150.md): Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing (CVSS 7.5)
- [CVE-2026-33754](https://cve.now/CVE-2026-33754.md): Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS) (CVSS 6.5)
- [CVE-2026-33434](https://cve.now/CVE-2026-33434.md): Wazuh: Rate Limit Bypass via /events Endpoint (CVSS 4.3)
- [CVE-2026-41499](https://cve.now/CVE-2026-41499.md): Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse\_uname\_string() (CVSS 6.5)
- [CVE-2026-30893](https://cve.now/CVE-2026-30893.md): Wazuh cluster sync path traversal in decompress\_files() enables arbitrary file write and code execution from authenticated cluster peer (CVSS 9.0)
- [CVE-2026-28221](https://cve.now/CVE-2026-28221.md): Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print\_hex\_string() due to signed char promotion on x86\_64 (CVSS 6.5)
- [CVE-2026-26206](https://cve.now/CVE-2026-26206.md): Wazuh: API brute-force protection bypass via race condition in login attempt tracking (CVSS 6.5)
- [CVE-2026-26204](https://cve.now/CVE-2026-26204.md): Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData (CVSS 4.4)
- [CVE-2025-15612](https://cve.now/CVE-2025-15612.md): Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE (CVSS 6.3)
- [CVE-2025-15617](https://cve.now/CVE-2025-15617.md): Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials (CVSS 8.3)
- [CVE-2025-15616](https://cve.now/CVE-2025-15616.md): Wazuh Agent and Manager OS Command Injection and Untrusted Search Path (CVSS 7.1)
- [CVE-2025-15615](https://cve.now/CVE-2025-15615.md): Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service (CVSS 6.9)
- [CVE-2023-7340](https://cve.now/CVE-2023-7340.md): Wazuh authd service (os\_auth) Heap-based Buffer Overflow (CVSS 5.3)
- [CVE-2026-32983](https://cve.now/CVE-2026-32983.md): SSL/TLS Renegotiation DoS in Wazuh Manager authd service (CVSS 6.9)
- [CVE-2026-32984](https://cve.now/CVE-2026-32984.md): Heap buffer overflow in wazuh-authd (CVSS 5.3)
- [CVE-2026-25790](https://cve.now/CVE-2026-25790.md): Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser (CVSS 4.9)
- [CVE-2026-25772](https://cve.now/CVE-2026-25772.md): Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow (CVSS 4.9)
- [CVE-2026-25771](https://cve.now/CVE-2026-25771.md): Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware (CVSS 5.3)
- [CVE-2026-25770](https://cve.now/CVE-2026-25770.md): Wazuh has Privilege Escalation to Root via Cluster Protocol File Write (CVSS 9.1)
- [CVE-2026-25769](https://cve.now/CVE-2026-25769.md): Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization (CVSS 9.1)
- [CVE-2025-64169](https://cve.now/CVE-2025-64169.md): Wazuh NULL pointer dereference in fim\_alert line 666 (CVSS 5.1)
- [CVE-2025-54866](https://cve.now/CVE-2025-54866.md): Wazuh installation fails to protected authd.pass on Windows (CVSS 1.8)
- [CVE-2025-30201](https://cve.now/CVE-2025-30201.md): Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities (CVSS 7.7)
- [CVE-2025-64483](https://cve.now/CVE-2025-64483.md): Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint (CVSS 5.3)
- [CVE-2025-62792](https://cve.now/CVE-2025-62792.md): Wazuh vulnerable to Heap-based Buffer Over-read in w\_expression\_match (CVSS 6.9)
- [CVE-2025-62791](https://cve.now/CVE-2025-62791.md): Wazuh vulnerable to NULL pointer dereference in DecodeCiscat (CVSS 6.9)
- [CVE-2025-62790](https://cve.now/CVE-2025-62790.md): Wazuh vulnerable to NULL pointer dereference in fim\_fetch\_attributes\_state (CVSS 6.9)
- [CVE-2025-62789](https://cve.now/CVE-2025-62789.md): Wazuh vulnerable to NULL pointer dereference in fim\_alert line 712 (CVSS 6.9)
- [CVE-2025-62788](https://cve.now/CVE-2025-62788.md): Wazuh Vulnerable to Heap Use After Free in w\_copy\_event\_for\_log (CVSS 6.3)
- [CVE-2025-62787](https://cve.now/CVE-2025-62787.md): Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt (CVSS 2.1)
- [CVE-2025-62786](https://cve.now/CVE-2025-62786.md): Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode\_win\_permissions (CVSS 6.3)
- [CVE-2025-62785](https://cve.now/CVE-2025-62785.md): Wazuh fillData NULL pointer dereference causes analysisd crash (CVSS 6.9)
- [CVE-2025-59938](https://cve.now/CVE-2025-59938.md): Heap buffer overflow in wazuh-analysisd (CVSS 6.5)
- [CVE-2024-1243](https://cve.now/CVE-2024-1243.md): Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft (CVSS 9.5)
- [CVE-2025-24016](https://cve.now/CVE-2025-24016.md): Remote code execution in Wazuh server (CVSS 9.9, KEV)
- [CVE-2024-35177](https://cve.now/CVE-2024-35177.md): Improper Access Control in wazuh-agent (CVSS 7.8)
- [CVE-2024-47770](https://cve.now/CVE-2024-47770.md): Ability to view Agent list with no privilege access in wazuh-dashboard (CVSS 4.6)
- [CVE-2024-32038](https://cve.now/CVE-2024-32038.md): Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8)
- [CVE-2023-50260](https://cve.now/CVE-2023-50260.md): Wazuh's vulnerability in host\_deny AR script allows arbitrary command execution (CVSS 8.8)
- [CVE-2023-49275](https://cve.now/CVE-2023-49275.md): Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd (CVSS 6.5)
- [CVE-2023-42463](https://cve.now/CVE-2023-42463.md): wazuh-logcollector integer underflow local privilege escalation (CVSS 7.4)
- [CVE-2023-42455](https://cve.now/CVE-2023-42455.md): Wazuh vulnerable to user privilege escalation (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wazuh
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.