https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-14T08:56:49.040771+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-74035 fkie_cve-2026-74035 2026-10-14T08:56:49.062549+00:00

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

 https://db.gcve.eu/vuln/ghsa-fv2h-v32g-xqfg GHSA-fv2h-v32g-xqfg 2026-10-14T08:56:49.062625+00:00

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.