Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.
Heap-based buffer overflow in Wazuh agent syscheck registry wildcard expansion (CVE-2026-40106)
A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards, the agent allocates a fixed 256-byte heap buffer and performs unsafe st...
Fixed in >=4.14.5
Rate limit bypass via /events endpoint in Wazuh Manager (CVE-2026-33434)
A logic error in `CheckRateLimitsMiddleware.dispatch()` unconditionally overwrites the global rate limit check result with the /events endpoint-specific check result, discarding whether the global `max_request_per_min...
Fixed in >= 4.14.5
Path traversal in Wazuh Manager agent enrollment (CVE-2026-39359)
CVE-2026-39359 is an unauthenticated path traversal vulnerability in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). A logic flaw allows agents to supply a group name containing ".....
Fixed in 4.10.4; 4.14.5