NNationalSecurityAgency

Products

Exploited and recent CVEs

• CVE-2026-54442 Medium 4.8 NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF 0.4%
• CVE-2026-116012 Low 3.6 Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser 0.2%
• CVE-2026-115503 Medium 5.5 Ghidra before 12.2 Denial of Service via Compressed Extension Archive 0.1%
• CVE-2026-115398 Medium 5.5 Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount 0.2%
• CVE-2026-115397 Medium 5.5 Ghidra before 12.2 Denial of Service via Extension Archive Install 0.1%
• CVE-2026-115396 Medium 5.5 Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive 0.1%
• CVE-2026-115395 Medium 5.5 Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() 0.1%
• CVE-2026-115394 Medium 5.5 Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation 0.2%
• CVE-2026-113604 Medium 5.5 Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts 0.2%
• CVE-2026-100505 Medium 4.4 Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager 0.1%
• CVE-2026-100504 High 7.0 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 0.2%
• CVE-2026-100503 Low 3.3 Ghidra through 12.1.4 Heap Use-After-Free in Decompiler 0.1%
• CVE-2026-96273 Medium 5.5 Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB 0.1%
• CVE-2026-54694 Critical 9.6 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover 0.5%
• CVE-2026-54389 Medium 5.5 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb 0.2%
• CVE-2026-52758 High 8.8 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search 0.3%
• CVE-2026-52757 Medium 4.4 Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation 0.1%
• CVE-2026-52756 Medium 4.8 Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server 0.5%
• CVE-2026-52755 High 7.8 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import 0.2%
• CVE-2026-52754 High 8.8 Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule 0.3%
• CVE-2026-52753 Medium 5.5 Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol 0.2%
• CVE-2026-52752 High 7.8 Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names 0.2%
• CVE-2026-52751 High 8.8 Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection 0.7%
• CVE-2026-52750 High 7.8 Ghidra < 12.1- Command Injection via URL Annotation Click 0.5%
• CVE-2026-49498 High 8.8 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username 0.3%
• CVE-2026-49497 Low 3.3 Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution 0.2%
• CVE-2026-49496 Medium 6.1 Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation 0.2%
• CVE-2026-49495 Medium 5.5 Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser 0.2%
• CVE-2024-58350 Low 2.9 Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order 0.1%
• CVE-2026-35582 High 8.8 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix 0.9%