Nationalsecurityagency vulnerabilities
39 CVEs and advisories name Nationalsecurityagency as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54442NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF
- CVE-2026-116012Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
- CVE-2026-115503Ghidra before 12.2 Denial of Service via Compressed Extension Archive
- CVE-2026-115398Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
- CVE-2026-115397Ghidra before 12.2 Denial of Service via Extension Archive Install
- CVE-2026-115396Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
- CVE-2026-115395Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
- CVE-2026-115394Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
- CVE-2026-113604Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
- CVE-2026-100505Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
- CVE-2026-100504Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
- CVE-2026-100503Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
- CVE-2026-96273Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB
- CVE-2026-54694NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-54389Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
- CVE-2026-52758Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
- CVE-2026-52757Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation
- CVE-2026-52756Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server
- CVE-2026-52755Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
- CVE-2026-52754Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
- CVE-2026-52753Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol
- CVE-2026-52752Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names
- CVE-2026-52751Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
- CVE-2026-52750Ghidra < 12.1- Command Injection via URL Annotation Click
- CVE-2026-49498Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
- CVE-2026-49497Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution
- CVE-2026-49496Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation
- CVE-2026-49495Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser
- CVE-2024-58350Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
- CVE-2026-35582Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix