# cve.now: Nationalsecurityagency

The newest entries naming Nationalsecurityagency as an affected vendor (up to 200), of 39 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-54442](https://cve.now/CVE-2026-54442.md): NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF (CVSS 4.8)
- [CVE-2026-116012](https://cve.now/CVE-2026-116012.md): Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser (CVSS 2.0)
- [CVE-2026-115503](https://cve.now/CVE-2026-115503.md): Ghidra before 12.2 Denial of Service via Compressed Extension Archive (CVSS 6.8)
- [CVE-2026-115398](https://cve.now/CVE-2026-115398.md): Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount (CVSS 6.8)
- [CVE-2026-115397](https://cve.now/CVE-2026-115397.md): Ghidra before 12.2 Denial of Service via Extension Archive Install (CVSS 6.8)
- [CVE-2026-115396](https://cve.now/CVE-2026-115396.md): Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive (CVSS 6.8)
- [CVE-2026-115395](https://cve.now/CVE-2026-115395.md): Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() (CVSS 6.8)
- [CVE-2026-115394](https://cve.now/CVE-2026-115394.md): Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation (CVSS 6.8)
- [CVE-2026-113604](https://cve.now/CVE-2026-113604.md): Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts (CVSS 6.8)
- [CVE-2026-100505](https://cve.now/CVE-2026-100505.md): Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager (CVSS 4.8)
- [CVE-2026-100504](https://cve.now/CVE-2026-100504.md): Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 (CVSS 7.3)
- [CVE-2026-100503](https://cve.now/CVE-2026-100503.md): Ghidra through 12.1.4 Heap Use-After-Free in Decompiler (CVSS 4.8)
- [CVE-2026-96273](https://cve.now/CVE-2026-96273.md): Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB (CVSS 6.8)
- [CVE-2026-54694](https://cve.now/CVE-2026-54694.md): NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover (CVSS 9.6)
- [CVE-2026-54389](https://cve.now/CVE-2026-54389.md): Ghidra \< 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb (CVSS 6.7)
- [CVE-2026-52758](https://cve.now/CVE-2026-52758.md): Ghidra \< 12.1 - SQL Injection via Unescaped Filter Values in BSim Search (CVSS 8.7)
- [CVE-2026-52757](https://cve.now/CVE-2026-52757.md): Ghidra \< 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation (CVSS 4.6)
- [CVE-2026-52756](https://cve.now/CVE-2026-52756.md): Ghidra \< 12.2 - Unauthenticated Path Traversal in Debugger ISF Server (CVSS 6.3)
- [CVE-2026-52755](https://cve.now/CVE-2026-52755.md): Ghidra \< 12.0.4 - Path Traversal via Zip Slip in Theme Import (CVSS 8.4)
- [CVE-2026-52754](https://cve.now/CVE-2026-52754.md): Ghidra \< 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule (CVSS 8.7)
- [CVE-2026-52753](https://cve.now/CVE-2026-52753.md): Ghidra \< 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol (CVSS 6.7)
- [CVE-2026-52752](https://cve.now/CVE-2026-52752.md): Ghidra \< 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names (CVSS 8.4)
- [CVE-2026-52751](https://cve.now/CVE-2026-52751.md): Ghidra \< 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection (CVSS 8.6)
- [CVE-2026-52750](https://cve.now/CVE-2026-52750.md): Ghidra \< 12.1- Command Injection via URL Annotation Click (CVSS 7.3)
- [CVE-2026-49498](https://cve.now/CVE-2026-49498.md): Ghidra 11.0 \< 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username (CVSS 8.7)
- [CVE-2026-49497](https://cve.now/CVE-2026-49497.md): Ghidra \< 12.1 - Path Traversal via .gnu\_debuglink in DWARF External Debug File Resolution (CVSS 4.6)
- [CVE-2026-49496](https://cve.now/CVE-2026-49496.md): Ghidra \< 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation (CVSS 6.9)
- [CVE-2026-49495](https://cve.now/CVE-2026-49495.md): Ghidra 10.2 \< 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser (CVSS 6.7)
- [CVE-2024-58350](https://cve.now/CVE-2024-58350.md): Ghidra \< 11.2 - Use After Free in Sleigh Backend via Static Initialization Order (CVSS 2.1)
- [CVE-2026-35582](https://cve.now/CVE-2026-35582.md): Emissary has an OS Command Injection via Unvalidated IN\_FILE\_ENDING / OUT\_FILE\_ENDING in Executrix (CVSS 8.8)
- [CVE-2026-35583](https://cve.now/CVE-2026-35583.md): Emissary has a Path Traversal via Blacklist Bypass in Configuration API (CVSS 5.3)
- [CVE-2026-35581](https://cve.now/CVE-2026-35581.md): Emissary has a Command Injection via PLACE\_NAME Configuration in Executrix (CVSS 7.2)
- [CVE-2026-35580](https://cve.now/CVE-2026-35580.md): Emissary has GitHub Actions Shell Injection via Workflow Inputs (CVSS 9.1)
- [CVE-2026-35571](https://cve.now/CVE-2026-35571.md): Emissary has Stored XSS via Navigation Template Link Injection (CVSS 4.8)
- [CVE-2025-27508](https://cve.now/CVE-2025-27508.md): Emissary Use of a Broken or Risky Cryptographic Algorithm (CVSS 7.5)
- [CVE-2024-39326](https://cve.now/CVE-2024-39326.md): SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill (CVSS 4.4)
- [CVE-2021-32639](https://cve.now/CVE-2021-32639.md): Server-Side Request Forgery (SSRF) in emissary:emissary (CVSS 7.2)
- [CVE-2021-32647](https://cve.now/CVE-2021-32647.md): Post-authentication Remote Code Execution (RCE) in emissary:emissary (CVSS 8.0)
- [CVE-2021-32634](https://cve.now/CVE-2021-32634.md): Deserialization of Untrusted Data in Emissary (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nationalsecurityagency
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.