Wget

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

1. GNU Wget: stack overflow in HTTP protocol handlingCVE-2017-13089GNU Project · CVSS 8.8 · 80% likely

   CWE-1211 bounty report

2. GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.CVE-2016-4971Gnu · 46% likely
3. Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary…CVE-2014-4877Gnu · 40% likely

   CWE-22

4. GNU Wget: heap overflow in HTTP protocol handlingCVE-2017-13090GNU Project · CVSS 8.8 · 37% likely

   CWE-1221 bounty report

5. GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.CVE-2018-0494Gnu · 16% likely

   CWE-20

6. wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal es…CVE-2004-1488Gnu · 12% likely
7. Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions…CVE-2016-7098Gnu · 7.5% likely

   CWE-362

8. The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP…CVE-2006-6719Gnu · 4.3% likely
9. Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2…CVE-2002-1344Gnu · 4.2% likely
10. GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or…CVE-2010-2252Gnu · 4.2% likely

    CWE-20

11. GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers t…CVE-2009-3490Gnu · 3.5% likely

    CWE-310

12. CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subc…CVE-2017-6508Gnu · 2.9% likely

    CWE-93

13. wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious serve…CVE-2004-1487Gnu · 1.7% likely
14. wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.CVE-1999-0402Gnu · 1.5% likely
15. GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.CVE-2021-31879Gnu · 1.1% likely

    CWE-601

16. GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLsCVE-2024-10524gnu · CVSS 6.5 · 1.1% likely

    CWE-918

17. Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.CVE-2004-2014Gnu · 1.0% likely
18. url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…CVE-2024-38428Gnu · CVSS 9.1 · 0.7% likely

    CWE-436

19. set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file,…CVE-2018-20483Gnu · 0.7% likely

    CWE-200

20. Denial of Service in GNU wgetCVE-2026-16599GNU · CVSS 5.1 · 0.4% likely

    CWE-606

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.