Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
CVE-2026-74047
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
CVE-2026-74045
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from inp
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
CVE-2026-74043
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
CVE-2026-74040
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
CVE-2026-74036
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by fi
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
CVE-2026-74035
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue
Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
CVE-2026-74033
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB lis
Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
CVE-2026-74032
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated u
Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
CVE-2026-74031
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file h
Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
CVE-2026-74030
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem
Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-a
Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
CVE-2026-109961
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject ar
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to
EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
CVE-2026-109959
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited fie
EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
CVE-2026-109958
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read re
EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
CVE-2026-109957
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Im