https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:50:35.023428+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-356454 EUVD-2026-356454 2026-10-02T19:50:35.026623+00:00 EUVD-2026-356454 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44901 fkie_cve-2026-44901 2026-10-02T19:50:35.026664+00:00

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2699 WID-SEC-W-2026-2699 — Wazuh: Mehrere Schwachstellen 2026-10-02T19:50:35.026710+00:00

Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen SQL-Injection Angriff durchzuführen.