https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29046.htmlhttps://patchthecve.com/cve/CVE-2026-29046.htmlWed, 17 Jun 2026 10:29:30 +0000HIGH 8.2: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CRhttps://patchthecve.com/cve/CVE-2026-28497.htmlhttps://patchthecve.com/cve/CVE-2026-28497.htmlWed, 17 Jun 2026 10:28:44 +0000CRITICAL 9.1: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can https://patchthecve.com/cve/CVE-2026-27633.htmlhttps://patchthecve.com/cve/CVE-2026-27633.htmlWed, 17 Jun 2026 10:27:25 +0000HIGH 7.5: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhaustion. Unauthenticated remote attackers can send an HTTP POST request to the server with an exceptionally large `Content-Length` header (e.g.https://patchthecve.com/cve/CVE-2026-27630.htmlhttps://patchthecve.com/cve/CVE-2026-27630.htmlWed, 17 Jun 2026 10:27:25 +0000HIGH 7.5: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate reqhttps://patchthecve.com/cve/CVE-2026-27613.htmlhttps://patchthecve.com/cve/CVE-2026-27613.htmlWed, 17 Jun 2026 10:27:23 +0000CRITICAL 9.8: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact ishttps://patchthecve.com/cve/CVE-2026-22781.htmlhttps://patchthecve.com/cve/CVE-2026-22781.htmlWed, 17 Jun 2026 10:20:24 +0000CRITICAL 9.8: TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unahttps://patchthecve.com/cve/CVE-2024-5193.htmlhttps://patchthecve.com/cve/CVE-2024-5193.htmlWed, 17 Jun 2026 08:15:22 +0000MEDIUM 5.3: A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publiclyhttps://patchthecve.com/cve/CVE-2024-34199.htmlhttps://patchthecve.com/cve/CVE-2024-34199.htmlWed, 17 Jun 2026 07:33:02 +0000HIGH 8.6: TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements in the request line.