CVE-2026-74xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
740 records · Page 8 of 8
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are
Updated- CVE-2026-74047: Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint 7.1 High
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against t
Updated Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the ma
Updated- CVE-2026-74045: Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder 7.1 High
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
Updated - CVE-2026-74044: Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello 7.0 High
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of
Updated Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
Updated- CVE-2026-74041: Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch 8.6 High
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
Updated - CVE-2026-74040: Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker 9.4 Critical
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager
Updated Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framewor
UpdatedWazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing
UpdatedWazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
UpdatedWazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
Updated- CVE-2026-74035: Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user 8.6 High
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
Updated Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
UpdatedWazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
Updated- CVE-2026-74032: Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions 5.3 Medium
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC policies, to map privileged actions and endpoints for privilege escalation planning.
Updated Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.
UpdatedWazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
UpdatedUnauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
UpdatedUnauthenticated Broken Access Control in Koji <= 2.2.1 versions.
Updated- CVE-2026-74019: WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability 7.1 High
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
Updated - CVE-2026-74018: WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability 9.9 Critical
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
Updated - CVE-2026-74017: WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability 5.3 Medium
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Updated - CVE-2026-74016: WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability 9.9 Critical
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
Updated Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
Updated- CVE-2026-74014: WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability 9.9 Critical
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
Updated - CVE-2026-74013: WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability 8.5 High
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
Updated Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.
UpdatedImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
UpdatedMissing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14.
UpdatedUnauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
UpdatedInsertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
UpdatedUnauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
Updated- CVE-2026-74006: WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability 4.3 Medium
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
Updated Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
UpdatedSubscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
UpdatedContributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
Updated- CVE-2026-74002: WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability 5.3 Medium
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
Updated - CVE-2026-74001: WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability 9.8 Critical
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Updated - CVE-2026-74000: WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability 5.3 Medium
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Updated