CVEs we hold for Nationalsecurityagency
Records whose assigning authority named Nationalsecurityagency as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-54694NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverNationalSecurityAgency skills-service
CVE-2026-54389Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbNationalSecurityAgency ghidra
CVE-2026-52758Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Searchnationalsecurityagency ghidra
CVE-2026-52757Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilationnationalsecurityagency ghidra
CVE-2026-52756Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Servernationalsecurityagency ghidra
CVE-2026-52755Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Importnationalsecurityagency ghidra
CVE-2026-52754Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModulenationalsecurityagency ghidra
CVE-2026-52753Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbolnationalsecurityagency ghidra
CVE-2026-52752Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Namesnationalsecurityagency ghidra
CVE-2026-52751Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connectionnationalsecurityagency ghidra
CVE-2026-52750Ghidra < 12.1- Command Injection via URL Annotation Clicknationalsecurityagency ghidra
CVE-2026-49498Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Usernamenationalsecurityagency ghidra
CVE-2026-49497Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolutionnationalsecurityagency ghidra
CVE-2026-49496Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocationnationalsecurityagency ghidra
CVE-2026-49495Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parsernationalsecurityagency ghidra
CVE-2026-35583Emissary has a Path Traversal via Blacklist Bypass in Configuration APINationalSecurityAgency emissary
CVE-2026-35582Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixNationalSecurityAgency emissary
CVE-2026-35581Emissary has a Command Injection via PLACE_NAME Configuration in ExecutrixNationalSecurityAgency emissary
CVE-2026-35580Emissary has GitHub Actions Shell Injection via Workflow InputsNationalSecurityAgency emissary
CVE-2026-35571Emissary has Stored XSS via Navigation Template Link InjectionNationalSecurityAgency emissary
CVE-2025-27508Emissary Use of a Broken or Risky Cryptographic AlgorithmNationalSecurityAgency emissary
CVE-2024-58350Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Ordernationalsecurityagency ghidra
CVE-2024-39326SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a SkillNationalSecurityAgency skills-service
CVE-2021-32647Post-authentication Remote Code Execution (RCE) in emissary:emissaryNationalSecurityAgency emissary
CVE-2021-32639Server-Side Request Forgery (SSRF) in emissary:emissaryNationalSecurityAgency emissary
26 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.