CE
Vendor
Cesanta
166
CVEs
0
On KEV
4
New 30D
Products
MO9.8
mongoose
cesanta
62 CVEs0 on KEV4 new
MJ9.8
mJS
Cesanta
85 CVEs0 on KEV0 new
MW9.8
Mongoose Web Server
Cesanta
11 CVEs0 on KEV0 new
ME8.8
Mongoose Embedded Web Server Library
Cesanta
3 CVEs0 on KEV0 new
FR5.3
Frozen
Cesanta
2 CVEs0 on KEV0 new
MO9.8
Mongoose OS
Cesanta
2 CVEs0 on KEV0 new
MM9.8
Mongooseos Mjs
Cesanta
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-63626 | MO mongoose cesanta | 8.8 | Oct 14 | Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) |
| CVE-2026-73261 | MO mongoose cesanta | 7.5 | Oct 14 | Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection |
| CVE-2026-73260 | MO mongoose cesanta | 7.5 | Oct 14 | Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser |
| CVE-2026-73252 | MO mongoose cesanta | 7.5 | Oct 14 | Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX |
| CVE-2026-101003 | MO Mongoose Cesanta | 5.3 | Sep 28 | Cesanta Mongoose MQTT Broker main.c fn stack-based overflow |
| CVE-2026-86716 | MJ mJS Cesanta | 7.3 | Sep 8 | Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow |
| CVE-2026-73253 | MO mongoose cesanta | 9.1 | Aug 20 | Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching |
| CVE-2026-73255 | MO mongoose cesanta | 6.5 | Aug 20 | Mongoose: Path traversal in SSI #include directives enables arbitrary file read |
| CVE-2026-73259 | MO mongoose cesanta | 5.4 | Aug 20 | Mongoose: Reflected XSS via decoded URI in directory listing render |
| CVE-2026-73256 | MO mongoose cesanta | 9.1 | Aug 20 | Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE |
| CVE-2026-73254 | MO mongoose cesanta | 5.4 | Aug 20 | Mongoose: Stored XSS via unescaped filenames in directory listing |
| CVE-2026-73258 | MO mongoose cesanta | 6.5 | Aug 20 | Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart |
| CVE-2026-73251 | MO mongoose cesanta | 9.1 | Aug 20 | Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification |
| CVE-2026-73257 | MO mongoose cesanta | 9.1 | Aug 20 | Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling |
| CVE-2026-11404 | MO Mongoose Cesanta | 7.5 | Jul 9 | Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing |
| CVE-2026-6986 | MO Mongoose Cesanta | 3.7 | Apr 25 | Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification |
| CVE-2026-6985 | MO Mongoose Cesanta | 7.5 | Apr 25 | Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop |
| CVE-2026-5246 | MO Mongoose Cesanta | 8.1 | Apr 2 | Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization |
| CVE-2026-5245 | MO Mongoose Cesanta | 8.1 | Apr 2 | Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow |
| CVE-2026-5244 | MO Mongoose Cesanta | 9.8 | Apr 2 | Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow |
| CVE-2018-25193 | MW Mongoose Web Server Cesanta | 7.5 | Mar 6 | Mongoose Web Server 6.9 Denial of Service via Socket Connection |
| CVE-2026-2968 | MO Mongoose Cesanta | 3.7 | Feb 23 | Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification |
| CVE-2026-2967 | MO Mongoose Cesanta | 3.7 | Feb 23 | Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source |
| CVE-2026-2966 | MO Mongoose Cesanta | 3.7 | Feb 23 | Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values |
| CVE-2025-65502 | MO Mongoose Cesanta | 4.3 | Nov 24 | Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where… |
| CVE-2025-51495 | MO Mongoose Cesanta | 7.5 | Sep 29 | An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17 |
| CVE-2025-0696 | FR Frozen Cesanta | 5.3 | Jan 27 | A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a… |
| CVE-2025-0695 | FR Frozen Cesanta | 5.3 | Jan 27 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the… |
| CVE-2024-42392 | MW Mongoose Web Server Cesanta | 7.5 | Nov 18 | Improper Neutralization of Delimiters in Mongoose Web Server library |
| CVE-2024-42391 | MW Mongoose Web Server Cesanta | 5.3 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42390 | MW Mongoose Web Server Cesanta | 5.3 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42389 | MW Mongoose Web Server Cesanta | 5.3 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42388 | MW Mongoose Web Server Cesanta | 5.3 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42387 | MW Mongoose Web Server Cesanta | 5.3 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42386 | MW Mongoose Web Server Cesanta | 7.5 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-42385 | MW Mongoose Web Server Cesanta | 7.0 | Nov 18 | Improper Neutralization of Delimiters in Mongoose Web Server library |
| CVE-2024-42384 | MW Mongoose Web Server Cesanta | 7.5 | Nov 18 | Integer Overflow or Wraparound in Mongoose Web Server library |
| CVE-2024-42383 | MW Mongoose Web Server Cesanta | 9.8 | Nov 18 | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2024-35492 | MO Mongoose Cesanta | 7.5 | May 29 | Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c |
| CVE-2024-35385 | MJ Mjs Cesanta | 4.3 | May 21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file |
| CVE-2024-35384 | MJ Mjs Cesanta | 5.5 | May 21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file |
| CVE-2024-35386 | MJ Mjs Cesanta | 7.5 | May 21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file |
| CVE-2023-49553 | MJ Mjs Cesanta | 7.5 | Jan 2 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file |
| CVE-2023-49552 | MJ Mjs Cesanta | 7.5 | Jan 2 | An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file |
| CVE-2023-49551 | MJ Mjs Cesanta | 7.5 | Jan 2 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file |
| CVE-2023-49550 | MJ Mjs Cesanta | 7.5 | Jan 2 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component |
| CVE-2023-49549 | MJ Mjs Cesanta | 7.5 | Jan 2 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file |
| CVE-2023-50044 | MJ Mjs Cesanta | 9.8 | Dec 20 | Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string |
| CVE-2023-43338 | MJ Mjs Cesanta | 9.8 | Sep 23 | Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr() |
| CVE-2020-25887 | MO Mongoose Cesanta | 8.8 | Aug 22 | Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file |
| CVE-2023-2905 | MO Mongoose Cesanta | 8.8 | Aug 9 | Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is… |
| CVE-2023-34188 | MO Mongoose Cesanta | 7.5 | Jun 23 | The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers |
| CVE-2023-30088 | MJ Mjs Cesanta | 5.5 | May 9 | An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c |
| CVE-2023-30087 | MJ Mjs Cesanta | 5.5 | May 9 | Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c |
| CVE-2023-29570 | MJ Mjs Cesanta | 5.5 | Apr 24 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c |
| CVE-2023-29569 | MJ Mjs Cesanta | 5.5 | Apr 14 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c |
| CVE-2023-29571 | MJ Mjs Cesanta | 5.5 | Apr 12 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c |
| CVE-2021-36535 | MJ Mjs Cesanta | 5.5 | Feb 3 | Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf |
| CVE-2021-33449 | MJ Mjs Cesanta | 5.5 | Jul 26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6) |
| CVE-2021-33448 | MJ Mjs Cesanta | 5.5 | Jul 26 | An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6) |