C
Vendor security profile
cesanta
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical4
CISA KEV0
Public exploit7
Patch rate%67
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
8
1
0
CVE KEV
CVE severity distribution
15toplam CVE
Critical4 (27%)
High5 (33%)
Medium6 (40%)
Patch and exploitation view
%67
Verified patch
%0
CISA KEV
%47
Public exploit
10Patch available
0Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
6.9
CVE-2026-101003
Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
C
Patch verifiedEPSS %0
9.1
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
C
Patch verifiedEPSS %0
6.5
CVE-2026-73255
Mongoose: Path traversal in SSI #include directives enables arbitrary file read
C
Patch verifiedEPSS %1
5.4
CVE-2026-73259
Mongoose: Reflected XSS via decoded URI in directory listing render
C
Patch verifiedEPSS %0
9.1
CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
C
Patch verifiedEPSS %0
5.4
CVE-2026-73254
Mongoose: Stored XSS via unescaped filenames in directory listing
C
Patch verifiedEPSS %0
6.5
CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
C
Patch verifiedEPSS %0
9.3
CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
C
Patch verifiedEPSS %0
9.1
CVE-2026-73257
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
C
Patch verifiedEPSS %1
8.7
CVE-2026-11404
Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing
C
Patch verifiedEPSS %1