CVE-2026-112337Low· 3.7▾ SunlitWazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.
wazuh >= 3.7.0 < 4.14.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112338Medium· 5.9Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
CVE-2026-112334Medium· 4.9Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
CVE-2026-112335Medium· 5.5Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
CVE-2026-112336Medium· 6.5Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
CVE-2026-112339Medium· 5.9Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
CVE-2026-112341Medium· 6.5Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params