NS
Vendor
NSA
47
CVEs
0
On KEV
6
New 30D
Products
GH9.8
Ghidra
NSA
31 CVEs0 on KEV6 new
EM9.9
Emissary
Nsa
13 CVEs0 on KEV0 new
GR5.5
GRASSMARLIN
NSA
1 CVEs0 on KEV0 new
SL–
Security-enhanced Linux
Nsa
1 CVEs0 on KEV0 new
SK4.4
Skills-service
Nsa
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115503 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via Compressed Extension Archive |
| CVE-2026-115398 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount |
| CVE-2026-115397 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via Extension Archive Install |
| CVE-2026-115396 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive |
| CVE-2026-115395 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() |
| CVE-2026-115394 | GH Ghidra Nsa | 5.5 | Oct 22 | Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation |
| CVE-2026-100505 | GH Ghidra Nsa | 4.4 | Sep 26 | Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager |
| CVE-2026-100504 | GH Ghidra Nsa | 7.0 | Sep 26 | Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 |
| CVE-2026-100503 | GH Ghidra Nsa | 5.5 | Sep 26 | Ghidra through 12.1.4 Heap Use-After-Free in Decompiler |
| CVE-2026-52759 | GH Ghidra Nsa | 5.5 | Jun 10 | Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser |
| CVE-2026-52758 | GH Ghidra Nsa | 8.8 | Jun 10 | Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search |
| CVE-2026-52757 | GH Ghidra Nsa | 4.4 | Jun 10 | Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation |
| CVE-2026-52756 | GH Ghidra Nsa | 6.5 | Jun 10 | Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server |
| CVE-2026-52755 | GH Ghidra Nsa | 7.8 | Jun 10 | Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import |
| CVE-2026-52754 | GH Ghidra Nsa | 8.8 | Jun 10 | Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule |
| CVE-2026-52753 | GH Ghidra Nsa | 5.5 | Jun 10 | Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol |
| CVE-2026-52752 | GH Ghidra Nsa | 7.8 | Jun 10 | Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names |
| CVE-2026-52751 | GH Ghidra Nsa | 8.8 | Jun 10 | Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection |
| CVE-2026-52750 | GH Ghidra Nsa | 7.8 | Jun 10 | Ghidra < 12.1- Command Injection via URL Annotation Click |
| CVE-2026-49498 | GH Ghidra Nsa | 8.8 | Jun 10 | Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username |
| CVE-2026-49497 | GH Ghidra Nsa | 3.3 | Jun 10 | Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution |
| CVE-2026-49496 | GH Ghidra Nsa | 6.1 | Jun 10 | Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation |
| CVE-2026-49495 | GH Ghidra Nsa | 5.5 | Jun 10 | Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser |
| CVE-2024-58350 | GH Ghidra Nsa | 4.0 | Jun 10 | Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order |
| CVE-2026-6807 | GR GRASSMARLIN NSA | 5.5 | Apr 28 | NSA GRASSMARLIN Improper Restriction of XML External Entity Reference |
| CVE-2026-35582 | EM Emissary Nsa | 8.8 | Apr 18 | Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix |
| CVE-2026-35583 | EM Emissary Nsa | 5.3 | Apr 7 | Emissary has a Path Traversal via Blacklist Bypass in Configuration API |
| CVE-2026-35581 | EM Emissary Nsa | 7.2 | Apr 7 | Emissary has a Command Injection via PLACE_NAME Configuration in Executrix |
| CVE-2026-35580 | EM Emissary Nsa | 9.1 | Apr 7 | Emissary has GitHub Actions Shell Injection via Workflow Inputs |
| CVE-2026-35571 | EM Emissary Nsa | 4.8 | Apr 7 | Emissary has Stored XSS via Navigation Template Link Injection |
| CVE-2026-4946 | GH Ghidra NSA | 8.8 | Mar 29 | NSA Ghidra Auto-Analysis Annotation Command Execution |
| CVE-2024-39326 | SK Skills-service Nsa | 4.4 | Jul 2 | SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill |
| CVE-2023-22671 | GH Ghidra Nsa | 9.8 | Jan 6 | Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with… |
| CVE-2021-32639 | EM Emissary Nsa | 9.9 | Jul 2 | Server-Side Request Forgery (SSRF) in emissary:emissary |
| CVE-2021-32647 | EM Emissary Nsa | 9.1 | May 28 | Post-authentication Remote Code Execution (RCE) in emissary:emissary |
| CVE-2021-32634 | EM Emissary Nsa | 7.2 | May 21 | Deserialization of Untrusted Data in Emissary |
| CVE-2021-32092 | EM Emissary Nsa | 6.1 | May 7 | A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S |
| CVE-2021-32093 | EM Emissary Nsa | 6.5 | May 7 | The ConfigFileAction component of U.S |
| CVE-2021-32094 | EM Emissary Nsa | 8.8 | May 7 | U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files |
| CVE-2021-32095 | EM Emissary Nsa | 8.1 | May 7 | U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files |
| CVE-2021-32096 | EM Emissary Nsa | 8.8 | May 7 | The ConsoleAction component of U.S |
| CVE-2019-17665 | GH Ghidra Nsa | 7.8 | Oct 16 | NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory |
| CVE-2019-17664 | GH Ghidra Nsa | 7.8 | Oct 16 | NSA Ghidra through 9.0.4 uses a potentially untrusted search path |
| CVE-2019-16941 | GH Ghidra Nsa | 9.8 | Sep 28 | NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML… |
| CVE-2019-13625 | GH Ghidra Nsa | 9.1 | Jul 17 | NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file |
| CVE-2019-13623 | GH Ghidra Nsa | 7.8 | Jul 17 | In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial… |
| CVE-2001-0073 | SL Security-enhanced Linux Nsa | – | Feb 12 | Buffer overflow in the find_default_type function in libsecure in NSA Security-enhanced Linux, which may allow attackers to modify critical data in memory |