Approved changes feed: RSS · Atom
cpe:2.3:a:gnu_wget:wget:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Gnu Wget (31f0043f-98d5-5a59-b2d3-db5983af6245) |
|---|---|
| Product | Wget (88a0114a-a2d3-59bc-83f0-1b4452e30ccf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15146 |
vulnerable | 2026-07-29 00:26:17.842576 |
CVE-2026-15146
GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.
Published: 2026-07-10T18:20:58.269Z
Updated: 2026-10-29T17:32:53.768Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.