https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:56:42.714979+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12055 bdu:2026-12055 2026-10-02T14:56:42.770468+00:00 bdu:2026-12055 https://cve.radiocsirt.org/vuln/euvd-2026-357504 EUVD-2026-357504 2026-10-02T14:56:42.770502+00:00 EUVD-2026-357504 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48024 fkie_cve-2026-48024 2026-10-02T14:56:42.770516+00:00

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled merge_type and name values in a merged synchronization archive. process_files_from_worker() in framework/wazuh/core/cluster/master.py does not adequately confine the resulting path to the declared cluster item directory. A cluster peer holding the shared Fernet key can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution when Wazuh services reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2699 WID-SEC-W-2026-2699 — Wazuh: Mehrere Schwachstellen 2026-10-02T14:56:42.770549+00:00

Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen SQL-Injection Angriff durchzuführen.