Nsa

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Nsa product.

RSS Feeds for Nsa security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Nsa products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Nsa Sorted by Most Security Vulnerabilities since 2018

Nsa Emissary8 vulnerabilities

Nsa Ghidra7 vulnerabilities

By the Year

In 2026 there have been 2 vulnerabilities in Nsa with an average score of 7.2 out of ten. Nsa did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	2	7.15
2025	0	0.00
2024	0	0.00
2023	1	9.80
2022	0	0.00
2021	8	8.06
2020	0	0.00
2019	5	0.00

It may take a day or so for new Nsa vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Nsa Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-6807	Apr 28, 2026	Grassmarlin 3.2.1 XML Session Data Info Disclosure A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
CVE-2026-4946	Mar 29, 2026	Ghidra <12.0.3: @execute Annotation Enables Arbitrary UI Command Execution Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analysts machine.	Ghidra
CVE-2023-22671	Jan 06, 2023	Ghidra <=10.2.2 command injection via launch.sh eval Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.	Ghidra
CVE-2021-32639	Jul 02, 2021	Emissary is a P2P-based, data-driven workflow engine Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.	Emissary
CVE-2021-32647	Jun 01, 2021	Emissary is a P2P based data-driven workflow engine Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `<constructor>(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.	Emissary
CVE-2021-32634	May 21, 2021	Emissary is a distributed, peer-to-peer, data-driven workflow framework Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources.	Emissary
CVE-2021-32093	May 07, 2021	The ConfigFileAction component of U.S The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.	Emissary
CVE-2021-32092	May 07, 2021	A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.	Emissary
CVE-2021-32095	May 07, 2021	U.S. National Security Agency (NSA) Emissary 5.9.0 allows an U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.	Emissary
CVE-2021-32094	May 07, 2021	U.S. National Security Agency (NSA) Emissary 5.9.0 allows an U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.	Emissary