Vulnerabilidades en wazuh
97 resultadosCVE-2026-28220HIGHWazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master nodeEPSS 0.7%CVE-2026-48162CRITICALWazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh managerEPSS 0.7%CVE-2026-74035HIGHWazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_userEPSS 0.6%CVE-2026-44255MEDIUMWazuh: Username Enumeration via Timing Side-ChannelEPSS 0.6%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.6%CVE-2026-74044HIGHWazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster HelloEPSS 0.6%CVE-2026-74046MEDIUMWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip BombEPSS 0.6%CVE-2026-54083HIGHWazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletionEPSS 0.6%CVE-2026-112334MEDIUMWazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.confEPSS 0.6%CVE-2026-112336HIGHWazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON DecoderEPSS 0.6%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.6%CVE-2026-74038HIGHWazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent EnrollmentEPSS 0.5%CVE-2026-44252HIGHWazuh Manager dapi RBAC Bypass Allows Privilege EscalationEPSS 0.5%CVE-2025-15615MEDIUMWazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of ServiceEPSS 0.5%CVE-2026-74031HIGHWazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete HelpersEPSS 0.5%CVE-2026-44254MEDIUMWazuh: Stack Out-of-Bounds Write in remoted Decompression PathEPSS 0.5%CVE-2026-25771MEDIUMWazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication MiddlewareEPSS 0.5%CVE-2026-74037HIGHWazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenEPSS 0.5%CVE-2026-44256MEDIUMWazuh: CRLF Log Injection via Unsanitized Basic-Auth UsernameEPSS 0.5%CVE-2026-41424HIGHWazuh: Privilege Escalation via Admin-Protection Bypass in update-user API EndpointEPSS 0.5%