VendorsNSAemissaryall versions
Vulnerabilities

NSA Emissary

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

13CVEs
CVE-2021-32639
Server-Side Request Forgery (SSRF) in emissary:emissary
Published 2021-07-02 · Modified
9.9EPSS 0.014
CVE-2021-32647
Post-authentication Remote Code Execution (RCE) in emissary:emissary
Published 2021-05-28 · Modified
9.1EPSS 0.029
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Published 2026-04-07 · Analyzed
9.1EPSS 0.007
CVE-2021-32094
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
Published 2021-05-07 · Modified
8.8EPSS 0.012
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Published 2026-04-18 · Analyzed
8.8EPSS 0.011
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
Published 2021-05-07 · Modified
8.8EPSS 0.006
CVE-2021-32095
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
Published 2021-05-07 · Modified
8.1EPSS 0.009
CVE-2021-32634
Deserialization of Untrusted Data in Emissary
Published 2021-05-21 · Modified
7.2EPSS 0.013
CVE-2026-35581
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Published 2026-04-07 · Analyzed
7.2EPSS 0.009
CVE-2021-32093
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.
Published 2021-05-07 · Modified
6.5EPSS 0.010
CVE-2021-32092
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.
Published 2021-05-07 · Modified
6.1EPSS 0.010
CVE-2026-35583
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Published 2026-04-07 · Analyzed
5.3EPSS 0.004
CVE-2026-35571
Emissary has Stored XSS via Navigation Template Link Injection
Published 2026-04-07 · Analyzed
4.8EPSS 0.003