W
Vendor security profile1 actively exploited CVEs
wazuh
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs53
Critical8
CISA KEV1
Public exploit40
Patch rate%74
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
3
0
0
0
7
25
2
15
CVE KEV
CVE severity distribution
53toplam CVE
Critical8 (15%)
High29 (55%)
Medium15 (28%)
Uncertain1 (2%)
Patch and exploitation view
%74
Verified patch
%2
CISA KEV
%75
Public exploit
39Patch available
0Partial
1Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
6.9
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
W
Patch verified
6.9
CVE-2026-93346
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
W
Patch verified
7.1
CVE-2026-74047
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
W
Patch verified
7.1
CVE-2026-74045
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
W
Patch verified
8.5
CVE-2026-74043
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
W
Patch verified
9.4
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
W
Patch verified
9.4
CVE-2026-74040
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
W
Patch verified
8.6
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
W
Patch verified
8.6
CVE-2026-74036
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
W
Patch verified
8.6
CVE-2026-74035
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
W
Patch verified