Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Nsa

First CVE: Feb 12, 2001Active for: 25 yearsTotal CVEs: 36
38.4
VTI Score
Medium

The National Security Agency's publicly disclosed vulnerability footprint, though narrow in product scope, carries significance because its releases include reverse-engineering tools and security research implementations such as Ghidra and Emissary that reach specialized but technically proficient user bases. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, reflecting the security-critical nature of analysis and middleware components. The exposure recurs through weakness classes including path traversal, untrusted deserialization, cross-site scripting, and command-injection variants that are characteristic of tools handling untrusted input and complex file formats. Defenders tracking these products should prioritize patching, as the vendor's releases target security practitioners and infrastructure operators whose compromise carries outsized risk. Current severity and exploitation figures are shown alongside this summary.

FAUCET AI Generated
36
Total CVEs
More Total CVEs than 98% of tracked vendors
2.4
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 90% of tracked vendors
7.3
Avg CVSS Score
Higher Avg CVSS Score than 54% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Nsa over time

Volume of CVEsAvg CVSS Base Score
First CVE
Feb 12, 2001
25 years ago
Most Recent CVE
Jun 10, 2026
45 days ago

Products(3 total)

Top CVEs

Signals from CVEs in this vendor scope (36 CVEs).

36 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2019-13623HIGH
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial
Jul 17, 20197.838NOYES
CVE-2026-52751HIGH
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers c
Jun 10, 20268.837NONO
CVE-2026-52758HIGH
Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization.
Jun 10, 20268.835NONO
CVE-2026-52754HIGH
Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate
Jun 10, 20268.835NONO
CVE-2026-49498HIGH
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolat
Jun 10, 20268.835NONO
CVE-2026-52750HIGH
Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arb
Jun 10, 20267.834NONO
CVE-2019-16941CRITICAL
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML docu
Sep 28, 20199.834NONO
CVE-2026-52755HIGH
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers
Jun 10, 20267.832NONO
CVE-2026-52752HIGH
Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious exte
Jun 10, 20267.832NONO
CVE-2026-4946HIGH
Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst i
Mar 29, 20268.832NONO
View all 36 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products36 CVEs
31%
47%
17%
Severity distribution among all CVEs352,708 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local14 (38.9%)
Network21 (58.3%)
Unknown1 (2.8%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low34 (94.4%)
High1 (2.8%)
Unknown1 (2.8%)
User Interaction
None18 (50.0%)
Unknown1 (2.8%)
Required17 (47.2%)
Privileges Required
Low8 (22.2%)
High5 (13.9%)
None22 (61.1%)
Unknown1 (2.8%)

Exploit Exposure

Signals from CVEs in this vendor scope (36 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
2.8% of CVEs· 75th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Nsa.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Nsa — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Nsa's Products

View all 4 CNAs →

Top CWEs