# wazuh.

Every CVE that names wazuh among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML](https://agentprime.io/advisories/CVE-2026-62365.md)
  `CVE-2026-62365` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption
- [Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion](https://agentprime.io/advisories/CVE-2026-71540.md)
  `CVE-2026-71540` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Wazuh: Unbounded Recursion in os_xml \`\_getattributes()\` Causes analysisd Worker Thread Stack Exhaustion](https://agentprime.io/advisories/CVE-2026-61811.md)
  `CVE-2026-61811` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config](https://agentprime.io/advisories/CVE-2026-61802.md)
  `CVE-2026-61802` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)](https://agentprime.io/advisories/CVE-2026-61800.md)
  `CVE-2026-61800` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key](https://agentprime.io/advisories/CVE-2026-61783.md)
  `CVE-2026-61783` · CVE record: wazuh wazuh · CVSS 7.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: Information disclosure, Broken access control
- [Wazuh agent enrollment NULL pointer dereference via malformed manager response](https://agentprime.io/advisories/CVE-2026-54084.md)
  `CVE-2026-54084` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Memory corruption
- [Wazuh: Missing input validation in multiple active response scripts allows argument injection](https://agentprime.io/advisories/CVE-2026-54085.md)
  `CVE-2026-54085` · CVE record: wazuh wazuh · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion](https://agentprime.io/advisories/CVE-2026-54083.md)
  `CVE-2026-54083` · CVE record: wazuh wazuh · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal
- [Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd](https://agentprime.io/advisories/CVE-2026-49392.md)
  `CVE-2026-49392` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection, CWE-20
- [Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username](https://agentprime.io/advisories/CVE-2026-44256.md)
  `CVE-2026-44256` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field](https://agentprime.io/advisories/CVE-2026-45798.md)
  `CVE-2026-45798` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption, CWE-170
- [Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager](https://agentprime.io/advisories/CVE-2026-49441.md)
  `CVE-2026-49441` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint](https://agentprime.io/advisories/CVE-2026-41424.md)
  `CVE-2026-41424` · CVE record: wazuh wazuh · CVSS 8.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Wazuh: Username Enumeration via Timing Side-Channel](https://agentprime.io/advisories/CVE-2026-44255.md)
  `CVE-2026-44255` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-208
- [Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager](https://agentprime.io/advisories/CVE-2026-48024.md)
  `CVE-2026-48024` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager](https://agentprime.io/advisories/CVE-2026-48162.md)
  `CVE-2026-48162` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-44901.md)
  `CVE-2026-44901` · CVE record: wazuh wazuh · CVSS 8.4 High · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path](https://agentprime.io/advisories/CVE-2026-44254.md)
  `CVE-2026-44254` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()](https://agentprime.io/advisories/CVE-2026-46343.md)
  `CVE-2026-46343` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation](https://agentprime.io/advisories/CVE-2026-44253.md)
  `CVE-2026-44253` · CVE record: wazuh wazuh · CVSS 4.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service
- [Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation](https://agentprime.io/advisories/CVE-2026-44252.md)
  `CVE-2026-44252` · CVE record: wazuh wazuh · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync](https://agentprime.io/advisories/CVE-2026-67307.md)
  `CVE-2026-67307` · CVE record: wazuh wazuh · CVSS 7.0 High · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-345
- [Wazuh GitHub Actions Shell Injection via Fork Pull Request](https://agentprime.io/advisories/CVE-2026-67308.md)
  `CVE-2026-67308` · CVE record: wazuh wazuh · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: Command injection
- [Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node](https://agentprime.io/advisories/CVE-2026-28220.md)
  `CVE-2026-28220` · CVE record: wazuh wazuh · CVSS 8.4 High · Not analysed yet · Published 20 Jul 2026 · Tags: Insecure deserialization
- [Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message](https://agentprime.io/advisories/CVE-2026-44251.md)
  `CVE-2026-44251` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Memory corruption
- [Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)](https://agentprime.io/advisories/CVE-2026-40106.md)
  `CVE-2026-40106` · CVE record: wazuh wazuh · CVSS 4.7 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Memory corruption
- [Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name](https://agentprime.io/advisories/CVE-2026-39359.md)
  `CVE-2026-39359` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Path traversal
- [Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing](https://agentprime.io/advisories/CVE-2026-34150.md)
  `CVE-2026-34150` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Memory corruption
- [Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)](https://agentprime.io/advisories/CVE-2026-33754.md)
  `CVE-2026-33754` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Denial of service
- [Wazuh: Rate Limit Bypass via /events Endpoint](https://agentprime.io/advisories/CVE-2026-33434.md)
  `CVE-2026-33434` · CVE record: wazuh wazuh · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-799
- [Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()](https://agentprime.io/advisories/CVE-2026-41499.md)
  `CVE-2026-41499` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Memory corruption
- [Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer](https://agentprime.io/advisories/CVE-2026-30893.md)
  `CVE-2026-30893` · CVE record: wazuh wazuh · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Path traversal
- [Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64](https://agentprime.io/advisories/CVE-2026-28221.md)
  `CVE-2026-28221` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Memory corruption, Denial of service
- [Wazuh: API brute-force protection bypass via race condition in login attempt tracking](https://agentprime.io/advisories/CVE-2026-26206.md)
  `CVE-2026-26206` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Authentication bypass, Race condition
- [Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData](https://agentprime.io/advisories/CVE-2026-26204.md)
  `CVE-2026-26204` · CVE record: wazuh wazuh · CVSS 4.4 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Memory corruption
- [Wazuh authd service (os_auth) Heap-based Buffer Overflow](https://agentprime.io/advisories/CVE-2023-7340.md)
  `CVE-2023-7340` · CVE record: Wazuh Wazuh · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Memory corruption
- [Heap buffer overflow in wazuh-authd](https://agentprime.io/advisories/CVE-2026-32984.md)
  `CVE-2026-32984` · CVE record: Wazuh Wazuh · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Memory corruption
- [Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser](https://agentprime.io/advisories/CVE-2026-25790.md)
  `CVE-2026-25790` · CVE record: wazuh wazuh · CVSS 4.9 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow](https://agentprime.io/advisories/CVE-2026-25772.md)
  `CVE-2026-25772` · CVE record: wazuh wazuh · CVSS 4.9 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware](https://agentprime.io/advisories/CVE-2026-25771.md)
  `CVE-2026-25771` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Denial of service
- [Wazuh has Privilege Escalation to Root via Cluster Protocol File Write](https://agentprime.io/advisories/CVE-2026-25770.md)
  `CVE-2026-25770` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Mar 2026 · Tags: Path traversal, Privilege escalation, Broken access control
- [Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-25769.md)
  `CVE-2026-25769` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Mar 2026 · Tags: Insecure deserialization
- [Wazuh NULL pointer dereference in fim_alert line 666](https://agentprime.io/advisories/CVE-2025-64169.md)
  `CVE-2025-64169` · CVE record: wazuh wazuh · CVSS 5.1 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Memory corruption, CWE-252
- [Wazuh installation fails to protected authd.pass on Windows](https://agentprime.io/advisories/CVE-2025-54866.md)
  `CVE-2025-54866` · CVE record: wazuh wazuh · CVSS 1.8 Low · Not analysed yet · Published 21 Nov 2025 · Tags: Broken access control
- [Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities](https://agentprime.io/advisories/CVE-2025-30201.md)
  `CVE-2025-30201` · CVE record: wazuh wazuh · CVSS 7.7 High · Not analysed yet · Published 21 Nov 2025 · Tags: Path traversal, Authentication bypass
- [Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match](https://agentprime.io/advisories/CVE-2025-62792.md)
  `CVE-2025-62792` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: CWE-126, CWE-170
- [Wazuh vulnerable to NULL pointer dereference in DecodeCiscat](https://agentprime.io/advisories/CVE-2025-62791.md)
  `CVE-2025-62791` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption, CWE-252
- [Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state](https://agentprime.io/advisories/CVE-2025-62790.md)
  `CVE-2025-62790` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption, CWE-252
- [Wazuh vulnerable to NULL pointer dereference in fim_alert line 712](https://agentprime.io/advisories/CVE-2025-62789.md)
  `CVE-2025-62789` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption, CWE-252
- [Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_log](https://agentprime.io/advisories/CVE-2025-62788.md)
  `CVE-2025-62788` · CVE record: wazuh wazuh · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption
- [Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt](https://agentprime.io/advisories/CVE-2025-62787.md)
  `CVE-2025-62787` · CVE record: wazuh wazuh · CVSS 2.1 Low · Not analysed yet · Published 29 Oct 2025 · Tags: CWE-126
- [Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions](https://agentprime.io/advisories/CVE-2025-62786.md)
  `CVE-2025-62786` · CVE record: wazuh wazuh · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption
- [Wazuh fillData NULL pointer dereference causes analysisd crash](https://agentprime.io/advisories/CVE-2025-62785.md)
  `CVE-2025-62785` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Memory corruption, CWE-252
- [Heap buffer overflow in wazuh-analysisd](https://agentprime.io/advisories/CVE-2025-59938.md)
  `CVE-2025-59938` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 27 Sept 2025 · Tags: Memory corruption
- [Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-32038.md)
  `CVE-2024-32038` · CVE record: wazuh wazuh · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Apr 2024 · Tags: Memory corruption
- [Wazuh's vulnerability in host_deny AR script allows arbitrary command execution](https://agentprime.io/advisories/CVE-2023-50260.md)
  `CVE-2023-50260` · CVE record: wazuh wazuh · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.41 · Not analysed yet · Published 19 Apr 2024 · Tags: Code injection
- [Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd](https://agentprime.io/advisories/CVE-2023-49275.md)
  `CVE-2023-49275` · CVE record: wazuh wazuh · CVSS 6.5 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Memory corruption
- [wazuh-logcollector integer underflow local privilege escalation](https://agentprime.io/advisories/CVE-2023-42463.md)
  `CVE-2023-42463` · CVE record: wazuh wazuh · CVSS 7.4 High · Not analysed yet · Published 12 Jan 2024 · Tags: Memory corruption

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=wazuh>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/wazuh/>. Everything for agents: <https://agentprime.io/llms.txt>.