CVE Tools
Track your stack

Wazuh

119 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Wazuh, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Wazuh CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Wazuh CVEs per month
MonthCVEs
2024-120
2025-010
2025-024
2025-030
2025-040
2025-050
2025-061
2025-070
2025-080
2025-091
2025-108
2025-114
2025-120
2026-010
2026-020
2026-0312
2026-045
2026-050
2026-060
2026-077
2026-0825
2026-092
2026-100
2026-118

Severity

How the 119 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical119%
  • High4134%
  • Medium6454%
  • Low33%

Latest CVEs

The 15 most recently published vulnerabilities affecting Wazuh.

  1. CVE-2026-112341Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params6.5
  2. CVE-2026-112339Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module5.9
  3. CVE-2026-112338Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination5.9
  4. CVE-2026-112337Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination3.7
  5. CVE-2026-112335Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull5.5
  6. CVE-2026-112336Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder6.5
  7. CVE-2026-112334Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf4.9
  8. CVE-2026-62365Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML5.3
  9. CVE-2026-71540Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion7.5
  10. CVE-2026-61811Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion6.5
  11. CVE-2026-61802Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config6.5
  12. CVE-2026-61800Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)9.1
  13. CVE-2026-61783Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key6.5
  14. CVE-2026-54084Wazuh agent enrollment NULL pointer dereference via malformed manager response5.3
  15. CVE-2026-54085Wazuh: Missing input validation in multiple active response scripts allows argument injection7.1

Product grouping is registry-driven, with AI assist and human review. How it works