BU
Product
BusyBox
47
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 20Medium 17Low 4
Watch
Add BusyBox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76014 | 3.3 | Aug 19 | BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference Affected: 1.30.0; 1.30.1 |
| CVE-2025-46394 | 3.3 | Apr 23 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences Affected: through 1.37.0 |
| CVE-2026-38752 | 2.9 | Jul 15 | A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script Affected: 1.00 through 1.38.0 |
| CVE-2026-38755 | 2.9 | Jul 15 | A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input Affected: 0.52 through 1.38.0 |
Showing 4