CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wazuh:wazuh. Show all products

63 CVEs, showing 51 to 63PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-41424High 8.2Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-49441Critical 9.1Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-45798High 7.5Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-44256Medium 5.3Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-49392Medium 5.3Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-54083High 8.1Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-54085High 7.1Wazuh: Missing input validation in multiple active response scripts allows argument injection
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-54084Medium 5.3Wazuh agent enrollment NULL pointer dereference via malformed manager response
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-61783High 7.0Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-61800Critical 9.1Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-61802Medium 6.5Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
Assigned by GitHub_M
Aug 27, 2026
CVE-2026-61811Medium 6.5Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-71540High 7.5Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
Assigned by GitHub_M
Sep 24, 2026
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.