CVE Tools
Track your stack

Wazuh

77 CVEs tracked since 2025. Since Oct 2025, none of them reached CISA KEV.

Wazuh CVEs per month

Oct 2025 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Wazuh CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-1080
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-03120
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-0780
2026-08250
2026-099 or fewer
2026-10150
2026-1190

Products

The products that kept showing up in Wazuh's monthly top three, with their CVEs summed over those months.

  1. Wazuh575 months
  2. Wazuh-manager213 months
  3. Wazuh-agent21 month
  4. Wazuh (GitHub Actions)11 month
  5. Wazuh-dashboard-plugins11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Wazuh.

  1. CVE-2026-112341Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params6.5
  2. CVE-2026-112340Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request8.2
  3. CVE-2026-112339Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module5.9
  4. CVE-2026-112338Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination5.9
  5. CVE-2026-112337Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination3.7
  6. CVE-2026-112335Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull5.5
  7. CVE-2026-112336Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder6.5
  8. CVE-2026-112334Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf4.9
  9. CVE-2026-62365Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML5.3
  10. CVE-2026-93347Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file4.9
  11. CVE-2026-93346Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition5.3
  12. CVE-2026-74047Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint6.5
  13. CVE-2026-74045Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder7.1
  14. CVE-2026-74043Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions9.0
  15. CVE-2026-74041Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch7.2

The record

Peak rank
#51 in Nov 2026
Busiest month shown
Aug 2026, 25 CVEs
Months with a KEV entry
0 since Oct 2025
Monthly snapshots
6 since 2025
Wazuh's full record, month by month