GNU WGET2 vulnerabilities

3 CVEs affecting GNU WGET2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1858, published 2026-04-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-69194, published 2026-01-09. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse…
CVE-2025-69195, published 2026-01-09. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename…
CVE-2026-1858, published 2026-04-29. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different…