Wazuh

This hub aggregates every CVE we track for Wazuh, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wazuh.

• CVE-2026-61802Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config6.5Aug 27, 2026
• CVE-2026-61800Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)9.1Aug 27, 2026
• CVE-2026-61783Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key6.5Aug 27, 2026
• CVE-2026-54084Wazuh agent enrollment NULL pointer dereference via malformed manager response5.3Aug 27, 2026
• CVE-2026-54085Wazuh: Missing input validation in multiple active response scripts allows argument injection7.1Aug 27, 2026
• CVE-2026-54083Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion8.1Aug 27, 2026
• CVE-2026-49392Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd5.3Aug 19, 2026
• CVE-2026-44256Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username5.3Aug 19, 2026
• CVE-2026-45798Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field7.5Aug 19, 2026
• CVE-2026-49441Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager9.1Aug 19, 2026
• CVE-2026-41424Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint8.2Aug 19, 2026
• CVE-2026-44255Wazuh: Username Enumeration via Timing Side-Channel5.3Aug 19, 2026
• CVE-2026-48024Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager9.1Aug 19, 2026
• CVE-2026-48162Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager9.1Aug 19, 2026
• CVE-2026-44901Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability8.4Aug 19, 2026