Wazuh vulnerabilities
97 CVEs and advisories name Wazuh as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-54085Wazuh: Missing input validation in multiple active response scripts allows argument injection
- CVE-2026-54083Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
- CVE-2026-49392Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
- CVE-2026-44256Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
- CVE-2026-45798Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field
- CVE-2026-49441Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
- CVE-2026-41424Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint
- CVE-2026-44255Wazuh: Username Enumeration via Timing Side-Channel
- CVE-2026-48024Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager
- CVE-2026-48162Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager
- CVE-2026-44901Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-44254Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
- CVE-2026-46343Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
- CVE-2026-44253Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
- CVE-2026-44252Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
- CVE-2026-74046Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
- CVE-2026-74044Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
- CVE-2026-74039Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
- CVE-2026-74038Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
- CVE-2026-67307Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
- CVE-2026-67308Wazuh GitHub Actions Shell Injection via Fork Pull Request
- CVE-2026-28220Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node
- CVE-2026-44251Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message
- CVE-2026-40106Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)
- CVE-2026-39359Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name
- CVE-2026-34150Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing
- CVE-2026-33754Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)
- CVE-2026-33434Wazuh: Rate Limit Bypass via /events Endpoint
- CVE-2026-41499Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()
- CVE-2026-30893Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer