CVE-2018-20483

CVE-2018-20483 affects GNU Wget prior to 1.20.1, where set_file_metadata in xattr.c stores the file’s origin URL (and Referer info) in user.xdg.origin.url / user.xdg.referrer.url extended attributes. Local users could read these attributes and obtain sensitive information (e.g., credentials in th...

CVE-2026-58471

GNU Wget up to 1.25.0 contains a heap buffer overflow in convert_fname() (src/url.c) that can be triggered by a server-supplied filename requiring character set conversion. When the output buffer is too small and iconv E2BIG reallocates, the remaining space is miscalculated, allowing memory corru...

CVE-2026-58472

GNU Wget up to 1.25.0 contains a heap buffer overflow in html_quote_string() (src/convert.c) triggered by a server-supplied HTML attribute with extensive entity encoding. The root cause is a signed integer counter overflow during output size accumulation, leading to an undersized heap allocation ...