Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium6.9Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass e…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.1Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.Check if you run itEPSS 0.34%Oct 13, 2026
- Critical9.4Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.Check if you run itEPSS 0.37%Oct 13, 2026
- Critical9.4Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overw…Check if you run itEPSS 0.55%Oct 13, 2026
- High8.6Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.Check if you run itEPSS 0.39%Oct 13, 2026
- High8.6Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.Check if you run itEPSS 0.83%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.Check if you run itEPSS 0.34%Oct 13, 2026
- High8.4Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster work…Check if you run itEPSS 0.23%Oct 13, 2026
- Medium5.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unpro…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to…Check if you run itEPSS 0.51%Oct 13, 2026
- Medium6.5Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.45%Apr 29, 2026
- Critical9.9Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.62%Apr 29, 2026
- High8.2Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.57%Apr 29, 2026
- Medium6.5Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.28%Apr 29, 2026
- Medium5.5Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.18%Apr 29, 2026
- Medium6.3Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation.Check if you run itEPSS 0.22%Mar 27, 2026
- High8.3Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts.Check if you run itEPSS 0.39%Mar 27, 2026
- High7.1Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to exec…Check if you run itEPSS 1.63%Mar 27, 2026
- Medium6.9Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability th…Check if you run itEPSS 0.50%Mar 27, 2026
- Medium5.3Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input.Check if you run itEPSS 0.38%Mar 27, 2026
- Medium6.9Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability th…Check if you run itEPSS 0.54%Mar 27, 2026
- Medium5.3Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input.Check if you run itEPSS 0.32%Mar 27, 2026
- High7.2Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.60%Mar 17, 2026
31 records · page 1 of 2
PreviousNext