WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor gnu✕Product wget✕
Overview 26 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 7 public PoC · 1 EPSS ≥ 0.5
26matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 7public PoC26.9% 1EPSS ≥ 0.53.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 3.8% Not applicable 25 96.2% Withdrawn CVE 0 0.0%
Critical 3 11.5% High 8 30.8% Medium 14 53.8% Low 1 3.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 26 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 6 23.1% Proof of concept only 1 3.8% Forecast only 0 0.0% No public exploit 19 73.1%
split by peak 7 / year
Not applicable: 25Outside Waratek scope: 1 Low: 1Medium: 14High: 8Critical: 3 not blocked: 26 No public exploit: 19Proof of concept only: 1Working exploit published: 6
19991 Not applicable1 Medium1 not blocked1 No public exploit1 20000 20010 20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20041 Not applicable1 Low1 not blocked1 Working exploit published1 20052 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20061 Not applicable1 Medium1 not blocked1 Working exploit published1 20070 20080 20091 Not applicable1 Medium1 not blocked1 No public exploit1 20101 Not applicable1 Medium1 not blocked1 No public exploit1 20110 20120 20130 20141 Not applicable1 High1 not blocked1 No public exploit1 20150 20162 Not applicable2 High2 not blocked2 Working exploit published2 20173 Not applicable3 High2 Medium1 not blocked3 Proof of concept only1 No public exploit2 20182 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20191 Not applicable1 Critical1 not blocked1 No public exploit1 20200 20211 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20220 20230 20241 Not applicable1 Critical1 not blocked1 No public exploit1 20250 20267 Not applicable7 Critical1 High2 Medium4 not blocked7 No public exploit7
1999200220052008201120142017202020232026
26 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-58472 Medium 2026-07-07 Not applicable No public exploit GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.
CVE-2026-58471 Medium 2026-07-07 Not applicable No public exploit GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.
CVE-2026-58470 Medium 2026-07-07 Not applicable No public exploit GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.
CVE-2026-58469 High 2026-07-07 Not applicable No public exploit GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.
CVE-2026-1858 Medium 2026-04-29 Not applicable No public exploit wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
CVE-2025-69195 High 2026-01-09 Not applicable No public exploit A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
CVE-2025-69194 Critical 2026-01-09 Not applicable No public exploit A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
CVE-2024-38428 Critical 2024-06-16 Not applicable No public exploit url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
CVE-2021-31879 Medium 2021-04-29 Outside Waratek scope No public exploit GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
CVE-2019-5953 Critical 2019-05-17 Not applicable No public exploit Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.
CVE-2018-20483 High 2018-12-26 Not applicable No public exploit set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.
CVE-2018-0494 Medium 2018-05-06 Not applicable Working exploit published GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.
CVE-2017-13090 High 2017-10-27 Not applicable No public exploit The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
CVE-2017-13089 High 2017-10-27 Not applicable Proof of concept only The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
CVE-2017-6508 Medium 2017-03-07 Not applicable No public exploit CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
CVE-2016-7098 High 2016-09-26 Not applicable Working exploit published Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.
CVE-2016-4971 High 2016-06-30 Not applicable Working exploit published GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
CVE-2014-4877 High 2014-10-29 Not applicable No public exploit Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
CVE-2010-2252 Medium 2010-07-06 Not applicable No public exploit GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVE-2009-3490 Medium 2009-09-30 Not applicable No public exploit GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVE-2006-6719 Medium 2006-12-23 Not applicable Working exploit published The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command.
CVE-2004-1488 Medium 2005-04-27 Not applicable Working exploit published wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
CVE-2004-1487 Medium 2005-04-27 Not applicable No public exploit wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.
CVE-2004-2014 Low 2004-12-31 Not applicable Working exploit published Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.
CVE-2002-1344 Medium 2002-12-18 Not applicable No public exploit Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.
CVE-1999-0402 Medium 1999-01-02 Not applicable No public exploit wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.