https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2011-2900.htmlhttps://patchthecve.com/cve/CVE-2011-2900.htmlTue, 16 Jun 2026 23:32:12 +0000HIGH 7.5: Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an Hhttps://patchthecve.com/cve/CVE-2007-6405.htmlhttps://patchthecve.com/cve/CVE-2007-6405.htmlTue, 16 Jun 2026 22:48:00 +0000MEDIUM 6.4: Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vehttps://patchthecve.com/cve/CVE-2007-3541.htmlhttps://patchthecve.com/cve/CVE-2007-3541.htmlTue, 16 Jun 2026 22:42:15 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.