CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wazuh:manager. Show all products

18 CVEs, showing 1 to 18
CVESeverityTitlePublished
CVE-2026-74038High 7.1Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74039Medium 6.5Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74044Medium 6.5Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74046Medium 4.9Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
Assigned by VulnCheck
Aug 18, 2026
CVE-2026-74030Medium 4.9Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74031Medium 6.5Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74032Medium 4.3Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74033Medium 6.1Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74034High 7.5Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74035High 7.2Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74037High 7.2Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74040Critical 9.1Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74041Critical 9.1Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74043Critical 9.0Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74045High 7.1Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-74047Medium 6.5Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-93346Medium 5.3Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
Assigned by VulnCheck
Oct 13, 2026
CVE-2026-93347Medium 4.9Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
Assigned by VulnCheck
Oct 13, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.