CVE-2026-71540Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion Exploitation status Public exploit Fix Affected product W wazuh Published 09/24/2026 Severity High CVE-2026-61811Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion Exploitation status Public exploit Fix Affected product W wazuh Published 09/24/2026 Severity Medium CVE-2026-61802Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config Exploitation status Public exploit Fix Affected product W wazuh Published 08/27/2026 Severity Medium CVE-2026-61800Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) Exploitation status Not known exploited Fix Affected product W wazuh Published 08/27/2026 Severity Critical CVE-2026-61783Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key Exploitation status Public exploit Fix Affected product W wazuh Published 08/27/2026 Severity High CVE-2026-54084Wazuh agent enrollment NULL pointer dereference via malformed manager response Exploitation status Public exploit Fix Affected product W wazuh Published 08/27/2026 Severity Medium CVE-2026-54085Wazuh: Missing input validation in multiple active response scripts allows argument injection Exploitation status Not known exploited Fix Affected product W wazuh Published 08/27/2026 Severity High CVE-2026-54083Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion Exploitation status Public exploit Fix Affected product W wazuh Published 08/27/2026 Severity High CVE-2026-49392Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity Medium CVE-2026-44256Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username Exploitation status Not known exploited Fix Affected product W wazuh Published 08/19/2026 Severity Medium CVE-2026-45798Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity High CVE-2026-49441Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager Exploitation status Not known exploited Fix Affected product W wazuh Published 08/19/2026 Severity Critical CVE-2026-41424Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity High CVE-2026-44255Wazuh: Username Enumeration via Timing Side-Channel Exploitation status Not known exploited Fix Affected product W wazuh Published 08/19/2026 Severity Medium CVE-2026-48024Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity Critical CVE-2026-48162Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity Critical CVE-2026-44901Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity High CVE-2026-44254Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path Exploitation status Not known exploited Fix Affected product W wazuh Published 08/19/2026 Severity Medium CVE-2026-46343Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file() Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity High CVE-2026-44253Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity Medium CVE-2026-44252Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation Exploitation status Public exploit Fix Affected product W wazuh Published 08/19/2026 Severity High CVE-2026-74046Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb Exploitation status Public exploit Fix Affected product W wazuh-manager Published 08/18/2026 Severity Medium CVE-2026-74044Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello Exploitation status Not known exploited Fix Affected product W wazuh-manager Published 08/18/2026 Severity High CVE-2026-74039Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context Exploitation status Public exploit Fix Affected product W wazuh-manager Published 08/18/2026 Severity High CVE-2026-74038Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment Exploitation status Public exploit Fix Affected product W wazuh-manager Published 08/18/2026 Severity High CVE-2026-67307Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync Exploitation status Not known exploited Fix Affected product W wazuh Published 08/01/2026 Severity High CVE-2026-67308Wazuh GitHub Actions Shell Injection via Fork Pull Request Exploitation status Public exploit Fix Affected product W wazuh Published 08/01/2026 Severity Critical CVE-2026-28220Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node Exploitation status Public exploit Fix Affected product W wazuh Published 07/20/2026 Severity High CVE-2026-44251Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message Exploitation status Public exploit Fix Affected product W wazuh Published 07/17/2026 Severity Medium CVE-2026-40106Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS) Exploitation status Public exploit Fix Affected product W wazuh Published 07/16/2026 Severity Medium CVE-2026-39359Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name Exploitation status Public exploit Fix Affected product W wazuh Published 07/16/2026 Severity High CVE-2026-34150Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 07/16/2026 Severity High CVE-2026-33754Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS) Exploitation status Public exploit Fix Affected product W wazuh Published 07/16/2026 Severity Medium CVE-2026-33434Wazuh: Rate Limit Bypass via /events Endpoint Exploitation status Not known exploited Fix Affected product W wazuh Published 07/16/2026 Severity Medium CVE-2026-56699Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/15/2026 Severity Unknown CVE-2026-56401Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/08/2026 Severity Unknown CVE-2026-41499Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string() Exploitation status Public exploit Fix Affected product W wazuh Published 04/29/2026 Severity Medium CVE-2026-30893Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer Exploitation status Public exploit Fix Affected product W wazuh Published 04/29/2026 Severity Critical CVE-2026-28221Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64 Exploitation status Public exploit Fix Affected product W wazuh Published 04/29/2026 Severity Medium CVE-2026-26206Wazuh: API brute-force protection bypass via race condition in login attempt tracking Exploitation status Public exploit Fix Affected product W wazuh Published 04/29/2026 Severity Medium CVE-2026-26204Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData Exploitation status Public exploit Fix Affected product W wazuh Published 04/29/2026 Severity Medium CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE Exploitation status Public exploit Fix Not confirmed Affected product W Wazuh Provisioning Scripts (Agent Build Environment) Published 03/27/2026 Severity Medium CVE-2025-15617Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials Exploitation status Public exploit Fix Not confirmed Affected product W Wazuh (GitHub Actions) Published 03/27/2026 Severity High CVE-2025-15616Wazuh Agent and Manager OS Command Injection and Untrusted Search Path Exploitation status Public exploit Fix Affected product W wazuh-agent Published 03/27/2026 Severity High CVE-2025-15615Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service Exploitation status Public exploit Fix Not confirmed Affected product W wazuh-manager Published 03/27/2026 Severity Medium CVE-2023-7340Wazuh authd service (os_auth) Heap-based Buffer Overflow Exploitation status Public exploit Fix Affected product W wazuh Published 03/27/2026 Severity Medium CVE-2026-32983SSL/TLS Renegotiation DoS in Wazuh Manager authd service Exploitation status Not known exploited Fix Affected product W wazuh-manager Published 03/27/2026 Severity Medium CVE-2026-32984Heap buffer overflow in wazuh-authd Exploitation status Not known exploited Fix Not confirmed Affected product W wazuh Published 03/27/2026 Severity Medium CVE-2026-25790Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 03/17/2026 Severity Medium CVE-2026-25772Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 03/17/2026 Severity Medium CVE-2026-25771Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 03/17/2026 Severity Medium CVE-2026-25770Wazuh has Privilege Escalation to Root via Cluster Protocol File Write Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 03/17/2026 Severity Critical CVE-2026-25769Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 03/17/2026 Severity Critical CVE-2025-64169Wazuh NULL pointer dereference in fim_alert line 666 Exploitation status Public exploit Fix Affected product W wazuh Published 11/21/2025 Severity Medium CVE-2025-54866Wazuh installation fails to protected authd.pass on Windows Exploitation status Not known exploited Fix Affected product W wazuh Published 11/21/2025 Severity Low CVE-2025-30201Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities Exploitation status Public exploit Fix Affected product W wazuh Published 11/21/2025 Severity High CVE-2025-64483Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint Exploitation status Public exploit Fix Affected product W wazuh-dashboard-plugins Published 11/21/2025 Severity Medium CVE-2025-62792Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62791Wazuh vulnerable to NULL pointer dereference in DecodeCiscat Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62790Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62789Wazuh vulnerable to NULL pointer dereference in fim_alert line 712 Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62788Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_log Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62787Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt Exploitation status Public exploit Fix Affected product W wazuh Published 10/29/2025 Severity Low CVE-2025-62786Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions Exploitation status Not known exploited Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-62785Wazuh fillData NULL pointer dereference causes analysisd crash Exploitation status Not known exploited Fix Affected product W wazuh Published 10/29/2025 Severity Medium CVE-2025-59938Heap buffer overflow in wazuh-analysisd Exploitation status Public exploit Fix Affected product W wazuh Published 09/27/2025 Severity Medium CVE-2024-1243Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft Exploitation status Public exploit Fix Not confirmed Affected product W Wazuh Agent Published 06/11/2025 Severity Critical CVE-2025-24016Remote code execution in Wazuh server Exploitation status KEV Fix Not confirmed Affected product W wazuh Published 02/10/2025 Severity Critical CVE-2024-35177Improper Access Control in wazuh-agent Exploitation status Not known exploited Fix Not confirmed Affected product W wazuh Published 02/03/2025 Severity High CVE-2024-47770Ability to view Agent list with no privilege access in wazuh-dashboard Exploitation status Public exploit Fix Not confirmed Affected product W wazuh Published 02/03/2025 Severity Medium CVE-2024-32038Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability Exploitation status Not known exploited Fix Affected product W wazuh Published 04/19/2024 Severity Critical CVE-2023-50260Wazuh's vulnerability in host_deny AR script allows arbitrary command execution Exploitation status Public exploit Fix Affected product W wazuh Published 04/19/2024 Severity High CVE-2023-49275Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd Exploitation status Public exploit Fix Affected product W wazuh Published 04/19/2024 Severity Medium CVE-2023-42463wazuh-logcollector integer underflow local privilege escalation Exploitation status Not known exploited Fix Affected product W wazuh Published 01/12/2024 Severity High CVE-2023-42455Wazuh vulnerable to user privilege escalation Exploitation status Not known exploited Fix Not confirmed Affected product W wazuh-kibana-app Published 10/09/2023 Severity High CVE-2022-40497Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 09/27/2022 Severity High CVE-2021-44079Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 11/22/2021 Severity Unknown CVE-2021-41821Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 09/29/2021 Severity Unknown CVE-2021-26814Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 03/06/2021 Severity Unknown CVE-2018-19666Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 11/29/2018 Severity Unknown 
.svg){kind=icon}
.svg){kind=icon}
