BU
Product
BusyBox
48
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 20Medium 17Low 5
Watch
Add BusyBox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76014 | 3.3 | Aug 19 | BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference Affected: 1.30.0; 1.30.1 |
| CVE-2025-46394 | 3.3 | Apr 23 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences Affected: through 1.37.0 |
| CVE-2026-38752 | 2.9 | Jul 15 | A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script Affected: 1.00 through 1.38.0 |
| CVE-2026-38755 | 2.9 | Jul 15 | A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input Affected: 0.52 through 1.38.0 |
| CVE-2024-58251 | 2.5 | Apr 23 | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service… Affected: through 1.37.0 |
Showing 5