CVE-2026-151465.9MediumCWE-918

CVE-2026-15146: CVE-2026-15146

GNU wget · Wget

Vendor fix available · Affected: GNU wget Wget · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

5th percentile

050100

Higher than 5% of scored CVEs

5.9MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

GNU wget · WgetVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Server-Side Request Forgery
Vendor: GNU wget
Published: July 2026
Band: Unlikely (under 1%), July 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-15146 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.