Gnu Wget vulnerabilities

• gnu wget CVE-2026-94574 CVE-2026-94574 7.8 HighSeptember 22, 2026
• gnu wget Denial of Service in GNU wget CVE-2026-16599 Fix available 5.1 MediumAugust 25, 2026
• gnu wget CVE-2026-15146 CVE-2026-15146 Fix available 5.9 MediumJuly 10, 2026
• gnu wget GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding CVE-2026-58472 Fix available 6.0 MediumJuly 7, 2026
• gnu wget GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c CVE-2026-58471 Fix available 6.0 MediumJuly 7, 2026
• gnu wget GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing CVE-2026-58470 Fix available 6.9 MediumJuly 7, 2026
• gnu wget GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing CVE-2026-58469 Fix available 8.7 HighJuly 7, 2026
• gnu wget2 wget2 Improper Certificate Validation CVE-2026-1858 4.8 MediumApril 29, 2026
• gnu wget2 Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls CVE-2025-69195 Fix available 7.6 HighJanuary 7, 2026
• gnu wget2 Wget2: arbitrary file write via metalink path traversal in gnu wget2 CVE-2025-69194 Public exploitFix available 8.8 HighJanuary 7, 2026
• gnu wget GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs CVE-2024-10524 Fix available 6.5 MediumNovember 13, 2024
• gnu wget url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and... CVE-2024-38428 Fix available 9.1 CriticalJune 16, 2024
• gnu wget, broadcom brocade fabric operating system firmware, netapp 500f firmware +3 more +5 more GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different... CVE-2021-31879 Fix available 6.1 MediumApril 29, 2021
• gnu wget, the gnu projec gnu wget +1 more Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of... CVE-2019-5953 Fix available 9.8 CriticalApril 4, 2019
• gnu wget set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg... CVE-2018-20483 Fix available 7.8 HighDecember 26, 2018
• gnu wget, canonical ubuntu linux, debian linux +3 more +5 more GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in... CVE-2018-0494 Public exploitFix available EPSS 16.5% 6.5 MediumMay 6, 2018
• gnu wget, debian linux +1 more GNU Wget: heap overflow in HTTP protocol handling CVE-2017-13090 Fix available EPSS 36.6% 8.8 HighOctober 26, 2017
• gnu wget, debian linux +1 more GNU Wget: stack overflow in HTTP protocol handling CVE-2017-13089 Public exploitFix available EPSS 79.9% 8.8 HighOctober 26, 2017
• gnu wget CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows... CVE-2017-6508 Fix available 6.1 MediumMarch 7, 2017
• gnu wget Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a... CVE-2016-7098 Public exploitFix available 8.1 HighSeptember 23, 2016
• gnu wget, canonical ubuntu linux, oracle solaris +1 more +3 more GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request... CVE-2016-4971 Public exploitFix available EPSS 46.1% 8.8 HighJune 10, 2016
• gnu wget Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows... CVE-2014-4877 Fix available EPSS 39.9% 9.3 HighOctober 28, 2014
• gnu wget GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to... CVE-2010-2252 Fix available 6.8 MediumJuly 6, 2010
• gnu wget GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common... CVE-2009-3490 Fix available 6.8 MediumSeptember 30, 2009
• gnu wget The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows... CVE-2006-6719 Public exploitFix available 5.0 MediumDecember 23, 2006
• gnu wget wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses... CVE-2004-1488 Public exploitFix available EPSS 11.9% 5.0 MediumFebruary 15, 2005
• gnu wget wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a... CVE-2004-1487 Fix available 5.0 MediumFebruary 15, 2005
• gnu wget Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the... CVE-2004-2014 Public exploitFix available 2.6 LowDecember 31, 2004
• gnu wget, sun cobalt raq xtr +1 more Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or... CVE-2002-1344 Fix available 5.0 MediumDecember 11, 2002
• gnu wget wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself. CVE-1999-0402 5.0 MediumJanuary 2, 1999