{"kind": "product", "path": "vulns/debian-14/mongoose", "name": "mongoose", "product": "mongoose", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-63626", "noindex": false, "published": "2026-10-14T18:26:16.830Z", "modified": "2026-10-15T15:06:33.386Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00239, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-63626", "title": "Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)", "description": "Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9", "https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903", "https://github.com/cesanta/mongoose/releases/tag/7.23"], "fixes": ["7.23+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73261", "noindex": false, "published": "2026-10-14T18:25:41.102Z", "modified": "2026-10-14T18:25:41.102Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73261", "title": "Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection", "description": "Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-3fmr-92g4-wchx", "https://github.com/cesanta/mongoose/commit/cc7c6d2d18c28fcc6d085633dddd88402946140a", "https://github.com/cesanta/mongoose/releases/tag/7.23"], "fixes": ["7.23+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73260", "noindex": false, "published": "2026-10-14T18:25:00.518Z", "modified": "2026-10-20T01:50:00.898Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73260", "title": "Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser", "description": "Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-f6wr-mg35-p25g", "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e", "https://github.com/cesanta/mongoose/releases/tag/7.23"], "fixes": ["7.23+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73252", "noindex": false, "published": "2026-10-14T18:24:16.659Z", "modified": "2026-10-14T19:41:57.801Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00376, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73252", "title": "Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX", "description": "Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of ", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-hq58-98f5-2wg3", "https://github.com/cesanta/mongoose/commit/758e301f0c9a9885c1b716195df5fe6d6ac9d53e", "https://github.com/cesanta/mongoose/releases/tag/7.23"], "fixes": ["7.23+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-101003", "noindex": false, "published": "2026-09-28T05:30:14.021Z", "modified": "2026-10-01T14:06:48.183Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00462, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101003", "title": "Cesanta Mongoose MQTT Broker main.c fn stack-based overflow", "description": "A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.", "references": ["https://vuldb.com/vuln/410873", "https://vuldb.com/vuln/410873/cti", "https://vuldb.com/cve/CVE-2026-101003"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73253", "noindex": false, "published": "2026-08-20T17:41:02.495Z", "modified": "2026-08-20T18:36:17.262Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00344, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73253", "title": "Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching", "description": "Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-jp6g-796f-39vp", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73255", "noindex": false, "published": "2026-08-20T17:40:02.443Z", "modified": "2026-08-25T15:09:33.679Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00657, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73255", "title": "Mongoose: Path traversal in SSI #include directives enables arbitrary file read", "description": "Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-h7m9-764r-7x4x", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73259", "noindex": false, "published": "2026-08-20T17:39:16.147Z", "modified": "2026-08-20T19:51:19.095Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73259", "title": "Mongoose: Reflected XSS via decoded URI in directory listing render", "description": "Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-9cwm-487w-h25w", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73256", "noindex": false, "published": "2026-08-20T17:37:54.505Z", "modified": "2026-08-21T21:46:47.832Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00439, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73256", "title": "Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE", "description": "Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-mgp5-rjrv-h5j3", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73254", "noindex": false, "published": "2026-08-20T17:37:17.245Z", "modified": "2026-08-21T16:22:13.424Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00344, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73254", "title": "Mongoose: Stored XSS via unescaped filenames in directory listing", "description": "Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-5g6j-m3pv-4f7g", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73258", "noindex": false, "published": "2026-08-20T17:36:39.239Z", "modified": "2026-08-20T18:32:51.938Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00459, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73258", "title": "Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart", "description": "Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-cc55-8v3r-59p8", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73251", "noindex": false, "published": "2026-08-20T17:34:50.472Z", "modified": "2026-08-20T19:50:32.555Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73251", "title": "Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification", "description": "Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in ver", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-qj6j-2692-v2r8", "https://github.com/cesanta/mongoose/commit/2988bc9df3a5efc9539471cb7455975fa25df483", "https://github.com/cesanta/mongoose/releases/tag/7.23"], "fixes": ["7.23+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-73257", "noindex": false, "published": "2026-08-20T17:30:58.424Z", "modified": "2026-08-20T19:34:58.840Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00673, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-73257", "title": "Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling", "description": "Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.", "references": ["https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6", "https://github.com/cesanta/mongoose/pull/3611", "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52062", "noindex": false, "published": "2026-08-12T12:47:49.538436640Z", "modified": "2026-08-12T13:00:09.850657333Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52062", "title": "DEBIAN-CVE-2026-52062", "description": "DEBIAN-CVE-2026-52062", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52062", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52062"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52076", "noindex": false, "published": "2026-08-12T12:47:49.405078819Z", "modified": "2026-08-12T13:00:08.299540235Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52076", "title": "DEBIAN-CVE-2026-52076", "description": "DEBIAN-CVE-2026-52076", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52076", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52076"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52064", "noindex": false, "published": "2026-08-12T12:47:49.249673674Z", "modified": "2026-08-12T13:00:06.878523812Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52064", "title": "DEBIAN-CVE-2026-52064", "description": "DEBIAN-CVE-2026-52064", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52064", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52064"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52059", "noindex": false, "published": "2026-08-12T12:47:47.957345834Z", "modified": "2026-08-12T13:00:09.815024803Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52059", "title": "DEBIAN-CVE-2026-52059", "description": "DEBIAN-CVE-2026-52059", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52059", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52059"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52067", "noindex": false, "published": "2026-08-12T12:47:47.331401336Z", "modified": "2026-08-12T13:00:06.876486535Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52067", "title": "DEBIAN-CVE-2026-52067", "description": "DEBIAN-CVE-2026-52067", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52067", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52067"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52060", "noindex": false, "published": "2026-08-12T12:47:47.007057795Z", "modified": "2026-08-12T13:00:08.342405284Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52060", "title": "DEBIAN-CVE-2026-52060", "description": "DEBIAN-CVE-2026-52060", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52060", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52060"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-52069", "noindex": false, "published": "2026-08-12T12:47:46.888254442Z", "modified": "2026-08-12T13:00:09.928302650Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52069", "title": "DEBIAN-CVE-2026-52069", "description": "DEBIAN-CVE-2026-52069", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-52069", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-52069"], "fixes": ["7.22+ds-1"], "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}]}], "total": 43, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mongoose", "path": "vulns/debian-14/mongoose", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 5, "kev": 0}, "lastmod": "2026-10-20T01:50:00.898Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}