All tools / Detection engineering
WAZUH
Repository description, written by its ownerWazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Active last commit today
Commits in 52 of the last 52 weeks
- Category
- Detection engineering
- Subcategory
- Endpoint Monitoring
- License
- Other (GitHub could not identify it)
- Latest release
- Release v4.14.9, Oct 15, 2026 (source code only, no downloads)
- Stars
- 17.3K
- GitHub repository id
- 40556106
- Listed in
- awesome-threat-detection (CC0-1.0)
- Last checked
- Oct 19, 2026
Security advisories
Advisories the maintainers published on GitHub. Vulnerabilities reported only elsewhere, for example in the NVD, are not included.
- GHSA-cjf8-wjx6-hjw6 CVE-2026-74041 Critical Oct 13, 2026
Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root - GHSA-vc33-wcqf-cwgv CVE-2026-74033 Medium Oct 13, 2026
Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager - GHSA-3xm6-wp5v-2fm9 CVE-2026-74037 High Oct 13, 2026
Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator - GHSA-27gv-q7q6-f5qh CVE-2026-74035 High Oct 13, 2026
An empty password bypasses both the password policy and the reserved user guard in `security.update_user`, allowing a delegated user administrator to take over the `wazuh` superuser account - GHSA-gc4j-j9fg-4cfr CVE-2026-74045 High Oct 13, 2026
Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine - GHSA-crrg-5qvw-8wjx CVE-2026-93346 Medium Oct 13, 2026
API brute-force protection is still bypassable by concurrent login requests, the `asyncio.Lock` fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race - GHSA-qmhg-366r-jjfp CVE-2026-74036 High Oct 13, 2026
Remote code execution as root on Wazuh agents via SCA command policies - GHSA-xrjw-cqrv-j92g CVE-2026-93347 Medium Oct 13, 2026
Path traversal in cluster-callable get_list_file allows arbitrary file read as the wazuh user - GHSA-w4qc-m4j4-6m9c CVE-2026-74031 Medium Oct 13, 2026
Path traversal in cluster-callable rule/decoder delete helpers allows arbitrary file deletion as the wazuh user - GHSA-r7hm-43xr-477j CVE-2026-74034 High Oct 13, 2026
Arbitrary file read as root via agent-injected upgrade_custom command - GHSA-qj8j-r988-54rx CVE-2026-74047 Medium Oct 13, 2026
authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint - GHSA-vh8p-3xvw-w536 CVE-2026-74032 Medium Oct 13, 2026
RBAC Authorization Bypass in Wazuh API - GHSA-88p6-7cm8-xwj8 CVE-2026-74040 Critical Oct 13, 2026
Cluster worker can overwrite arbitrary master files (incl. ossec.conf) → root RCE on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement - GHSA-cw26-jj8q-x7w5 CVE-2026-74043 Critical Oct 13, 2026
Path traversal in cluster-callable upload functions allows arbitrary file write as the wazuh user - GHSA-x8v7-g49q-ff7j CVE-2026-74030 Medium Oct 13, 2026
SCA YAML alias expansion causes memory exhaustion - GHSA-whhr-gxxr-f6pm CVE-2026-62365 Medium Aug 18, 2026
Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML - GHSA-9wv5-7qwx-m9w5 CVE-2026-61811 Medium Aug 18, 2026
Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion - GHSA-vjcq-cf36-f5gx CVE-2026-61783 High Aug 18, 2026
RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key - GHSA-chmg-89pf-2q82 CVE-2026-61802 Medium Aug 18, 2026
Cluster authentication key disclosed to low-privilege cluster:read API users via GET /cluster/local/config (missing mask_sensitive_config) — enables cluster-peer RCE chain - GHSA-3jff-488g-335f CVE-2026-61800 High Aug 18, 2026
Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes
Changes seen by hackshelf
- Oct 19, 2026 First checked, status Active