en
Cesanta Software Ltd is an embedded-software company headquartered in Dublin, Ireland. It builds networking and Internet of Things software and hardware for connected products, with an emphasis on helping embedded-device developers add network connectivity, web interfaces, and device-management capabilities.
As of 09/14/2026, Cesanta recorded 10 security vulnerabilities in the last 90 days across 2 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Mongoose had the most security vulnerabilities in the Cesanta ecosystem, with 9 vulnerabilities—approximately 90% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-86716Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productmJS | Published09/08/2026 | SeverityMedium |
CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityCritical |
CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file read | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityMedium |
CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing render | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityMedium |
CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE | Exploitation statusNot known exploited | FixYes | Affected productMongoose | Published08/20/2026 | SeverityCritical |
CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityMedium |
CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityMedium |
CVE-2026-73251Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification | Exploitation statusNot known exploited | FixYes | Affected productMongoose | Published08/20/2026 | SeverityCritical |
CVE-2026-73257Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/20/2026 | SeverityCritical |
CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing | Exploitation statusNot known exploited | FixYes | Affected productMongoose | Published07/09/2026 | SeverityHigh |
CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published04/25/2026 | SeverityMedium |
CVE-2026-6985Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published04/25/2026 | SeverityMedium |
CVE-2026-5246Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published04/02/2026 | SeverityMedium |
CVE-2026-5245Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow | Exploitation statusNot known exploited | FixYes | Affected productMongoose | Published04/02/2026 | SeverityMedium |
CVE-2026-5244Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow | Exploitation statusNot known exploited | FixYes | Affected productMongoose | Published04/02/2026 | SeverityMedium |
CVE-2018-25193Mongoose Web Server 6.9 Denial of Service via Socket Connection | Exploitation statusPublic exploit | FixNot confirmed | Affected productMongoose Web Server | Published03/06/2026 | SeverityHigh |
CVE-2026-2968Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification | Exploitation statusPublic exploit | FixNot confirmed | Affected productMongoose | Published02/23/2026 | SeverityMedium |
CVE-2026-2967Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source | Exploitation statusPublic exploit | FixNot confirmed | Affected productMongoose | Published02/23/2026 | SeverityMedium |
CVE-2026-2966Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values | Exploitation statusPublic exploit | FixNot confirmed | Affected productMongoose | Published02/23/2026 | SeverityMedium |
CVE-2025-65502 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/24/2025 | SeverityMedium |
CVE-2025-51495 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/29/2025 | SeverityHigh |
CVE-2025-0696 | Exploitation statusNot known exploited | FixYes | Affected productFrozen | Published01/27/2025 | SeverityMedium |
CVE-2025-0695 | Exploitation statusNot known exploited | FixYes | Affected productFrozen | Published01/27/2025 | SeverityMedium |
CVE-2024-42392Improper Neutralization of Delimiters in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42391Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42390Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42389Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42388Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42387Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42386Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityHigh |
CVE-2024-42385Improper Neutralization of Delimiters in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-42384Integer Overflow or Wraparound in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityHigh |
CVE-2024-42383Use of Out-of-range Pointer Offset in Mongoose Web Server library | Exploitation statusNot known exploited | FixYes | Affected productMongoose Web Server | Published11/18/2024 | SeverityMedium |
CVE-2024-35385 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published05/21/2024 | SeverityMedium |
CVE-2024-35384 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published05/21/2024 | SeverityMedium |
CVE-2024-35386 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/21/2024 | SeverityHigh |
CVE-2023-49552 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/02/2024 | SeverityHigh |
CVE-2023-49550 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/02/2024 | SeverityHigh |
CVE-2023-49549 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/02/2024 | SeverityHigh |
CVE-2023-49553 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/02/2024 | SeverityHigh |
CVE-2023-49551 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/02/2024 | SeverityHigh |
CVE-2023-50044 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/20/2023 | SeverityUnknown |
CVE-2023-43338 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/22/2023 | SeverityUnknown |
CVE-2020-25887 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2023-2905Cesanta Mongoose MQTT Message Parsing Heap Overflow | Exploitation statusPublic exploit | FixYes | Affected productMongoose | Published08/09/2023 | SeverityUnknown |
CVE-2023-34188 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published06/23/2023 | SeverityUnknown |
CVE-2023-30088 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published05/09/2023 | SeverityMedium |
CVE-2023-30087 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/09/2023 | SeverityMedium |
CVE-2023-29570 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/24/2023 | SeverityMedium |
CVE-2023-29569 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/14/2023 | SeverityMedium |
CVE-2023-29571 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/12/2023 | SeverityMedium |
CVE-2021-36535 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published02/03/2023 | SeverityMedium |
CVE-2021-33443 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33444 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33445 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33446 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33447 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33448 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33449 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33442 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33441 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33440 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33439 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33438 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-33437 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/26/2022 | SeverityUnknown |
CVE-2021-27425Cesanta Software Mongoose-OS Integer Overflow or Wraparound | Exploitation statusNot known exploited | FixYes | Affected productMongoose-OS | Published05/03/2022 | SeverityHigh |
CVE-2022-25299Arbitrary File Write | Exploitation statusNot confirmed | FixYes | Affected productcesanta/mongoose | Published02/18/2022 | SeverityCritical |
CVE-2021-46556 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46554 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46553 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46550 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46549 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46548 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46547 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46546 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46545 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46544 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46543 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46542 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46541 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46540 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46539 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46538 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46537 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46535 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46534 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46532 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46531 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46530 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46528 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46529 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46527 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46526 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46525 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46524 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46523 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46522 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46521 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46520 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CVE-2021-46519 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2022 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
