The National Security Agency's publicly disclosed vulnerability footprint, though narrow in product scope, carries significance because its releases include reverse-engineering tools and security research implementations such as Ghidra and Emissary that reach specialized but technically proficient user bases. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, reflecting the security-critical nature of analysis and middleware components. The exposure recurs through weakness classes including path traversal, untrusted deserialization, cross-site scripting, and command-injection variants that are characteristic of tools handling untrusted input and complex file formats. Defenders tracking these products should prioritize patching, as the vendor's releases target security practitioners and infrastructure operators whose compromise carries outsized risk. Current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nsa over time
Signals from CVEs in this vendor scope (36 CVEs).
36 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-13623HIGH In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial | Jul 17, 2019 | 7.8 | 38 | NO | YES |
CVE-2026-52751HIGH Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers c | Jun 10, 2026 | 8.8 | 37 | NO | NO |
CVE-2026-52758HIGH Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-52754HIGH Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-49498HIGH Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolat | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-52750HIGH Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arb | Jun 10, 2026 | 7.8 | 34 | NO | NO |
CVE-2019-16941CRITICAL NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML docu | Sep 28, 2019 | 9.8 | 34 | NO | NO |
CVE-2026-52755HIGH Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers | Jun 10, 2026 | 7.8 | 32 | NO | NO |
CVE-2026-52752HIGH Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious exte | Jun 10, 2026 | 7.8 | 32 | NO | NO |
CVE-2026-4946HIGH Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst i | Mar 29, 2026 | 8.8 | 32 | NO | NO |
Signals from CVEs in this vendor scope (36 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nsa.
Media articles that mention a CVE ID that affects a product developed by Nsa — matched by CVE ID, not by vendor name.