The vulnerability of the Corosync cluster engine, which allows a hacker to trigger a service failure

The vulnerability of the Corosync cluster engine is related to incorrect checking of the return value of a function. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-48024

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

CVE-2026-48024

Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 are affected by a path traversal in cluster synchronization. The function cluster.unmerge_info() constructs file paths from peer-controlled merge_type and name values, and process_files_from_worker() fails...

The vulnerability of the inventory_sync() function in the Wazuh Manager’s cluster synchronization component allows a perpetrator to execute arbitrary code. This vulnerability exists in the monitoring and threat detection tools provided by Wazuh.

The vulnerability of the inventorysync function in the Wazuh Manager’s cluster synchronization component, a platform for security monitoring and threat detection, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability could allow an attacker...

CVE-2026-30893

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the...

CVE-2026-30893 Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the...

CVE-2026-30893

Wazuh cluster sync path traversal (CVE-2026-30893) affects versions 4.4.0–4.14.3. The vulnerability occurs in the cluster synchronization extraction routine (decompress_files()), enabling an authenticated cluster peer to write arbitrary files outside the extraction directory. This can escalate to...

EUVD-2026-26271

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the...

CVE-2026-30893: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the...

Wazuh 路径遍历漏洞

Wazuh is an open-source application developed by Wazuh. It is used for collecting, summarizing, indexing, and analyzing security data, helping organizations detect intrusions, threats, and abnormal behaviors. Versions of Wazuh from 4.4.0 to 4.14.4 contained a path traversal vulnerability. This...

The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, allows attackers to escalate their privileges.

The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges...

PT-2026-35967

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.3 Description A path traversal issue exists in the cluster synchronization extraction routine, specifically within the decompress files function. This allows an authenticated cluster peer to write arbitrary...

Wazuh 安全漏洞

Wazuh is an open-source application developed by Wazuh. It is used for collecting, summarizing, indexing, and analyzing security data, helping organizations detect intrusions, threats, and abnormal behaviors. Versions of Wazuh from 3.9.0 to 4.14.3 contained security vulnerabilities. These...

CVE-2018-20810

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...

The vulnerability of the Kubernetes cluster synchronization software, which relies on configuration sources like Flux and the Kubernetes package manager Helm, arises from improper resource cleanup or release mechanisms. This allows attackers to trigger service failures.

The vulnerability of the Kubernetes cluster synchronization software, which relies on configuration sources like Flux and the Kubernetes package manager Helm, is related to improper resource cleanup or release. Exploiting this vulnerability allows a malicious actor to cause service failures...

[SECURITY] [DLA 2515-1] csync2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2515-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 04, 2021 https://wiki.debian.org/LTS -...

Unspecified Vulnerability in LINBIT csync2

LINBIT csync2 is a cluster synchronization tool from the Austrian company LINBIT, which is mainly used to keep files on multiple hosts in a cluster synchronized. A security vulnerability exists in the ''csyncdaemonsession''function in the daemon.c file in LINBIT csync2 2.0 and earlier versions,...

CVE-2018-20810

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...

CVE-2018-20810

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...

Session fixation

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...