52 matches found
PT-2026-70992
Name of the Vulnerable Software and Affected Versions Wazuh Manager affected versions not specified Description A deserialization of untrusted data issue exists in the Cluster DAPI Protocol, which allows a remote attacker to execute arbitrary code and perform arbitrary file read and write...
CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...
CVE-2026-56699
Wazuh Manager before 5.0.0-beta3 has a vulnerability where the DataValue.index field is not escaped when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed und...
EUVD-2026-44630
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...
CVE-2026-56699
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Per Wazuh's Security Policy, vulnerabilities affecting only non-GA versions are not eligible for a CVE ID...
CVE-2026-8643 vulnerabilities
Vulnerabilities for packages: wazuh-manager-fips, nvidia-nsight-compute-13.3, request-1276, nvidia-nsight-compute-13.1, graalvm, nvidia-nsight-compute-13.2...
GHSA-WF93-45JW-7689 vulnerabilities
Vulnerabilities for packages: wazuh-manager-fips, nvidia-nsight-compute-13.3, request-1276, nvidia-nsight-compute-13.1, graalvm, nvidia-nsight-compute-13.2...
CVE-2026-48710 vulnerabilities
Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, nemo, tritonserver-backend-vllm-cuda-12.9...
GHSA-86QP-5C8J-P5MR vulnerabilities
Vulnerabilities for packages: wazuh-manager, wazuh-manager-fips, nemo, tritonserver-backend-vllm-cuda-12.9...
The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, allows attackers to escalate their privileges.
The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges...
CVE-2025-15615
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lac...
CVE-2026-32983
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lac...
EUVD-2025-209102
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lac...
EUVD-2026-16686
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lac...
CVE-2025-15615
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lac...
CVE-2025-15616
Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR...
CVE-2025-15616 Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR...
CVE-2025-15616
Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR...
CVE-2025-15616 Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR...