Nationalsecurityagency vulnerabilities

Products

• Ghidra 27
• Emissary 10
• Skills-service 2

Newest

• nationalsecurityagency emissary NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF CVE-2026-54442 Fix available 4.8 MediumOctober 30, 2026
• nationalsecurityagency ghidra Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser CVE-2026-116012 Public exploit 2.0 LowOctober 24, 2026
• nationalsecurityagency ghidra Ghidra before 12.2 Denial of Service via Compressed Extension Archive CVE-2026-115503 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount CVE-2026-115398 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra before 12.2 Denial of Service via Extension Archive Install CVE-2026-115397 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive CVE-2026-115396 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() CVE-2026-115395 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation CVE-2026-115394 6.8 MediumOctober 22, 2026
• nationalsecurityagency ghidra Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts CVE-2026-113604 6.8 MediumOctober 20, 2026
• nationalsecurityagency ghidra Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager CVE-2026-100505 4.8 MediumSeptember 26, 2026
• nationalsecurityagency ghidra Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 CVE-2026-100504 7.3 HighSeptember 26, 2026
• nationalsecurityagency ghidra Ghidra through 12.1.4 Heap Use-After-Free in Decompiler CVE-2026-100503 4.8 MediumSeptember 26, 2026
• nationalsecurityagency ghidra Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB CVE-2026-96273 6.8 MediumSeptember 23, 2026
• nationalsecurityagency skills-service NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover CVE-2026-54694 9.6 CriticalSeptember 9, 2026
• nationalsecurityagency ghidra Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb CVE-2026-54389 6.7 MediumAugust 20, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search CVE-2026-52758 8.7 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation CVE-2026-52757 4.6 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server CVE-2026-52756 6.3 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import CVE-2026-52755 8.4 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule CVE-2026-52754 8.7 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol CVE-2026-52753 6.7 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names CVE-2026-52752 8.4 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection CVE-2026-52751 8.6 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1- Command Injection via URL Annotation Click CVE-2026-52750 7.3 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username CVE-2026-49498 8.7 HighJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution CVE-2026-49497 4.6 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation CVE-2026-49496 6.9 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser CVE-2026-49495 6.7 MediumJune 10, 2026
• nationalsecurityagency ghidra Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order CVE-2024-58350 2.1 LowJune 10, 2026
• nationalsecurityagency emissary Emissary has a Path Traversal via Blacklist Bypass in Configuration API CVE-2026-35583 Fix available 5.3 MediumApril 7, 2026
• nationalsecurityagency emissary Emissary has a Command Injection via PLACE_NAME Configuration in Executrix CVE-2026-35581 Fix available 7.2 HighApril 7, 2026
• nationalsecurityagency emissary Emissary has Stored XSS via Navigation Template Link Injection CVE-2026-35571 Fix available 4.8 MediumApril 7, 2026
• nationalsecurityagency emissary Emissary has GitHub Actions Shell Injection via Workflow Inputs CVE-2026-35580 Public exploitFix available 9.1 CriticalApril 6, 2026
• nationalsecurityagency emissary Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix CVE-2026-35582 Fix available 8.8 HighApril 3, 2026
• nationalsecurityagency emissary Emissary Use of a Broken or Risky Cryptographic Algorithm CVE-2025-27508 Fix available 7.5 HighMarch 5, 2025
• nationalsecurityagency skills-service SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill CVE-2024-39326 4.4 MediumJuly 2, 2024
• nationalsecurityagency emissary Server-Side Request Forgery (SSRF) in emissary:emissary CVE-2021-32639 7.2 HighJuly 2, 2021
• nationalsecurityagency emissary Post-authentication Remote Code Execution (RCE) in emissary:emissary CVE-2021-32647 8.0 HighMay 28, 2021
• nationalsecurityagency emissary Deserialization of Untrusted Data in Emissary CVE-2021-32634 7.2 HighMay 21, 2021