PT-2026-90310

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The OMAP SSI driver utilizes a synthetic HSI controller device allocated through the hsi alloc controller function. Because this process bypasses the standard OF/platform device...

NewStart CGSL MAIN 7.02 : httpd Vulnerability (NS-SA-2026-0094)

The remote NewStart CGSL host, running version MAIN 7.02, has httpd packages installed that are affected by a vulnerability: - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd=... directives...

TencentOS Server 3: nginx:1.24 (TSSA-2026:0886)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0886 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

JLSEC-2026-1379

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

PT-2026-85157

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mg ssi function in src/ssi.c concatenates the directive argument into a filesystem pa...

CVE-2026-77945

A command injection vulnerability exists in TRENDnet TEW-821DAP firmware version 2.2.01b05 , specifically in the ssi component within the file /cgi-bin/upload.cgi. An attacker can manipulate the filename argument to inject arbitrary commands. The attack is remotely exploitable and requires low pr...

CVE-2026-77945 TRENDnet TEW-821DAP ssi upload.cgi command injection

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

CVE-2026-77945 TRENDnet TEW-821DAP ssi upload.cgi command injection

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

CVE-2026-77945: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

Linux Distros Unpatched Vulnerability : CVE-2026-73255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI- enabled file can place directory traversal sequences ...

DEBIAN-CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

EUVD-2026-63499

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

CVE-2026-73255 is a path traversal vulnerability in Mongoose (an embedded web server and network library) prior to version 7.22 . The root cause is in the mg_ssi() function in src/ssi.c , which concatenates the #include or #include virtual directive argument into a filesystem path without calling...

PT-2026-79079

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mg ssi function in src/ssi.c concatenates the directive argument into a filesystem pa...