Login Request a demo
CE
Vendor
Cesanta
6 products with CVEs on record
153
CVEs
0
On KEV
4
New 30D
Products
MO
mongoose
cesanta
9.8
61 CVEs0 on KEV4 new
MJ
mJS
Cesanta
9.8
85 CVEs0 on KEV0 new
ME
Mongoose Embedded Web Server Library
Cesanta
8.8
3 CVEs0 on KEV0 new
MO
Mongoose OS
Cesanta
9.8
2 CVEs0 on KEV0 new
MW
Mongoose Web Server
Cesanta
7.5
1 CVEs0 on KEV0 new
MM
Mongooseos Mjs
Cesanta
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-63626
MO
mongoose
cesanta
8.8
0%
Oct 14Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
CVE-2026-73261
MO
mongoose
cesanta
7.5
0%
Oct 14Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
CVE-2026-73260
MO
mongoose
cesanta
7.5
0%
Oct 14Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
CVE-2026-73252
MO
mongoose
cesanta
7.5
0%
Oct 14Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX
CVE-2026-101003
MO
Mongoose
Cesanta
5.3
0%
Sep 28Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
CVE-2026-86716
MJ
mJS
Cesanta
7.3
1%
Sep 8Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
CVE-2026-73253
MO
mongoose
cesanta
9.1
0%
Aug 20Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
CVE-2026-73255
MO
mongoose
cesanta
6.5
1%
Aug 20Mongoose: Path traversal in SSI #include directives enables arbitrary file read
CVE-2026-73259
MO
mongoose
cesanta
5.4
0%
Aug 20Mongoose: Reflected XSS via decoded URI in directory listing render
CVE-2026-73256
MO
mongoose
cesanta
9.1
0%
Aug 20Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
CVE-2026-73254
MO
mongoose
cesanta
5.4
0%
Aug 20Mongoose: Stored XSS via unescaped filenames in directory listing
CVE-2026-73258
MO
mongoose
cesanta
6.5
0%
Aug 20Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
CVE-2026-73251
MO
mongoose
cesanta
9.1
0%
Aug 20Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
CVE-2026-73257
MO
mongoose
cesanta
9.1
1%
Aug 20Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
CVE-2026-11404
MO
Mongoose
Cesanta
7.5
1%
Jul 9Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing
CVE-2026-6986
MO
Mongoose
Cesanta
3.7
0%
Apr 25Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification
CVE-2026-6985
MO
Mongoose
Cesanta
7.5
1%
Apr 25Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop
CVE-2026-5246
MO
Mongoose
Cesanta
8.1
1%
Apr 2Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
CVE-2026-5245
MO
Mongoose
Cesanta
8.1
1%
Apr 2Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow
CVE-2026-5244
MO
Mongoose
Cesanta
9.8
1%
Apr 2Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
CVE-2018-25193
MW
Mongoose Web Server
Cesanta
7.5
0%
Mar 6Mongoose Web Server 6.9 Denial of Service via Socket Connection
CVE-2026-2968
MO
Mongoose
Cesanta
3.7
0%
Feb 23Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification
CVE-2026-2967
MO
Mongoose
Cesanta
3.7
1%
Feb 23Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
CVE-2026-2966
MO
Mongoose
Cesanta
3.7
0%
Feb 23Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
CVE-2025-65502
MO
Mongoose
Cesanta
4.3
0%
Nov 24Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where…
CVE-2025-51495
MO
Mongoose
Cesanta
7.5
0%
Sep 29An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17
CVE-2024-42392
MO
Mongoose
Cesanta
7.5
0%
Nov 18Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters
CVE-2024-42391
MO
Mongoose
Cesanta
5.3
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read…
CVE-2024-42390
MO
Mongoose
Cesanta
5.3
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read…
CVE-2024-42389
MO
Mongoose
Cesanta
5.3
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read…
CVE-2024-42388
MO
Mongoose
Cesanta
5.3
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read…
CVE-2024-42387
MO
Mongoose
Cesanta
5.3
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read…
CVE-2024-42386
MO
Mongoose
Cesanta
7.5
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the…
CVE-2024-42385
MO
Mongoose
Cesanta
7.0
0%
Nov 18Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected…
CVE-2024-42384
MO
Mongoose
Cesanta
7.5
0%
Nov 18Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the…
CVE-2024-42383
MO
Mongoose
Cesanta
9.8
0%
Nov 18Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field
CVE-2024-35386
MJ
Mjs
Cesanta
7.5
1%
May 21An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file
CVE-2024-35385
MJ
Mjs
Cesanta
4.3
1%
May 21An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file
CVE-2024-35384
MJ
Mjs
Cesanta
5.5
0%
May 21An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file
CVE-2023-49553
MJ
Mjs
Cesanta
7.5
1%
Jan 2An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file
CVE-2023-49552
MJ
Mjs
Cesanta
7.5
1%
Jan 2An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file
CVE-2023-49551
MJ
Mjs
Cesanta
7.5
1%
Jan 2An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file
CVE-2023-49550
MJ
Mjs
Cesanta
7.5
1%
Jan 2An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component
CVE-2023-49549
MJ
Mjs
Cesanta
7.5
1%
Jan 2An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file
CVE-2023-50044
MJ
Mjs
Cesanta
9.8
1%
Dec 20Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string
CVE-2023-43338
MJ
Mjs
Cesanta
9.8
1%
Sep 23Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr()
CVE-2020-25887
MO
Mongoose
Cesanta
8.8
1%
Aug 22Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file
CVE-2023-2905
MO
Mongoose
Cesanta
8.8
1%
Aug 9Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is…
CVE-2023-34188
MO
Mongoose
Cesanta
7.5
1%
Jun 23The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers
CVE-2023-30088
MJ
Mjs
Cesanta
5.5
0%
May 9An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c
CVE-2023-30087
MJ
Mjs
Cesanta
5.5
0%
May 9Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c
CVE-2023-29570
MJ
Mjs
Cesanta
5.5
0%
Apr 24Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c
CVE-2023-29569
MJ
Mjs
Cesanta
5.5
0%
Apr 14Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c
CVE-2023-29571
MJ
Mjs
Cesanta
5.5
0%
Apr 12Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c
CVE-2021-36535
MJ
Mjs
Cesanta
5.5
0%
Feb 3Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf
CVE-2021-33449
MJ
Mjs
Cesanta
5.5
0%
Jul 26An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6)
CVE-2021-33448
MJ
Mjs
Cesanta
5.5
0%
Jul 26An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6)
CVE-2021-33447
MJ
Mjs
Cesanta
5.5
0%
Jul 26An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6)
CVE-2021-33446
MJ
Mjs
Cesanta
5.5
0%
Jul 26An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6)
CVE-2021-33445
MJ
Mjs
Cesanta
5.5
0%
Jul 26An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6)