Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

wazuh-manager — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in wazuh-manager, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumeration entries specifically affecting the wazuh-manager product developed by the vendor Wazuh. It compiles a comprehensive list of security vulnerabilities, ranging from critical to low severity, that impact this open-source security platform. The dataset covers historical disclosures up to the most recent updates, ensuring a thorough view of the software’s security posture over time. Here, users can efficiently track vendor advisories related to Wazuh, allowing security teams to stay informed about patch availability and remediation steps for their environments. The page also helps analysts understand specific weakness classes, such as cross-site scripting, SQL injection, or improper access control, by providing context on how they manifest within the wazuh-manager codebase. Furthermore, users can look up the product’s vulnerability history to assess the long-term stability and maintenance practices of the software. This resource is designed to support incident response teams, developers, and security researchers in prioritizing fixes and strengthening defense mechanisms against known threats. By centralizing this data, the page reduces the effort required to monitor multiple sources for emerging risks associated with this specific management component. It serves as a single point of reference for evaluating the risk exposure of systems running wazuh-manager, facilitating more informed decision-making regarding upgrades and configuration changes. The information presented is derived from official advisories and recognized vulnerability databases to ensure accuracy and relevance for enterprise security operations.

Vendor: Wazuh

CVE ID Title CVSS Severity Published
CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition CWE-307 5.3 Medium 2026-10-13
CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file CWE-22 4.9 Medium 2026-10-13
CVE-2026-74045 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder CWE-122 7.1 High 2026-10-13
CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint CWE-200 6.5 Medium 2026-10-13
CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions CWE-22 9.0 Critical 2026-10-13
CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch CWE-178 9.1 Critical 2026-10-13
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker CWE-862 9.1 Critical 2026-10-13
CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token CWE-613 7.2 High 2026-10-13
CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user CWE-863 7.2 High 2026-10-13
CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command CWE-862 7.5 High 2026-10-13
CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions CWE-863 4.3 Medium 2026-10-13
CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers CWE-22 6.1 Medium 2026-10-13
CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers CWE-22 6.5 Medium 2026-10-13
CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb CWE-409 4.9 Medium 2026-08-18
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello CWE-22 6.5 Medium 2026-08-18
CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context CWE-770 6.5 Medium 2026-08-18
CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment CWE-22 7.1 High 2026-08-18
CVE-2025-15615 Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service CWE-276 5.8 Medium 2026-03-27
CVE-2026-32983 SSL/TLS Renegotiation DoS in Wazuh Manager authd service CWE-276 5.8 Medium 2026-03-27

All 19 known CVE vulnerabilities affecting wazuh-manager with full Chinese analysis, references, and POCs where available.