wazuh-agent vulnerabilities
CVEs whose affected-version data names the wazuh-agent package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-74036High· 7.2PoCWazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/inco…
▾ MidnightWazuh · wazuh-agentEPSS 0.83%via NVD
CVE-2026-74030Medium· 4.9Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy w…
▾ SunlitWazuh · wazuh-agentEPSS 0.40%via NVD