W
Vendor security profile1 actively exploited CVEs
wazuh
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs38
Critical6
CISA KEV1
Public exploit37
Patch rate%63
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
0
3
0
0
0
7
25
2
0
CVE KEV
CVE severity distribution
38toplam CVE
Critical6 (16%)
High20 (53%)
Medium11 (29%)
Uncertain1 (3%)
Patch and exploitation view
%63
Verified patch
%3
CISA KEV
%97
Public exploit
24Patch available
0Partial
1Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
7.5
CVE-2026-71540
Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
W
Patch status unknownEPSS %0
6.5
CVE-2026-61811
Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
W
Patch status unknownEPSS %0
6.5
CVE-2026-61802
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
W
Patch verifiedEPSS %1
9.1
CVE-2026-61800
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
W
Patch verifiedEPSS %1
7.0
CVE-2026-61783
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
W
Patch verifiedEPSS %0
5.3
CVE-2026-54084
Wazuh agent enrollment NULL pointer dereference via malformed manager response
W
Patch verifiedEPSS %0
7.1
CVE-2026-54085
Wazuh: Missing input validation in multiple active response scripts allows argument injection
W
Patch verifiedEPSS %0
8.1
CVE-2026-54083
Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
W
Patch verifiedEPSS %1
5.3
CVE-2026-49392
Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
W
Patch verifiedEPSS %0
5.3
CVE-2026-44256
Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
W
Patch verifiedEPSS %0