Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…EPSS 0.3%Oct 13, 2026
- Medium6.9Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests.Oct 13, 2026
- High7.1Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass e…EPSS 0.3%Oct 13, 2026
- High7.1Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.EPSS 0.3%Oct 13, 2026
- Critical9.4Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.EPSS 0.4%Oct 13, 2026
- Critical9.4Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overw…EPSS 0.6%Oct 13, 2026
- High8.6Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.EPSS 0.4%Oct 13, 2026
- High8.6Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.EPSS 0.8%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.EPSS 0.3%Oct 13, 2026
- High8.4Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster work…EPSS 0.2%Oct 13, 2026
- Medium5.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unpro…EPSS 0.3%Oct 13, 2026
- High7.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to…EPSS 0.5%Oct 13, 2026
- Medium6.5Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.4%Apr 29, 2026
- Critical9.9Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.6%Apr 29, 2026
- High8.2Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.6%Apr 29, 2026
- Medium6.5Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.3%Apr 29, 2026
- Medium5.5Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.2%Apr 29, 2026
- Medium6.3Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation.EPSS 0.2%Mar 27, 2026
- High8.3Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts.EPSS 0.4%Mar 27, 2026
- High7.1Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to exec…EPSS 1.6%Mar 27, 2026
- Medium6.9Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability th…EPSS 0.5%Mar 27, 2026
- Medium5.3Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input.EPSS 0.4%Mar 27, 2026
- Medium6.9Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability th…EPSS 0.5%Mar 27, 2026
- Medium5.3Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input.EPSS 0.3%Mar 27, 2026
- High7.2Wazuh is a free and open source platform used for threat prevention, detection, and response.EPSS 0.6%Mar 17, 2026
30 records · page 1 of 2
PreviousNext