https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-41615.htmlhttps://patchthecve.com/cve/CVE-2021-41615.htmlWed, 17 Jun 2026 04:08:43 +0000CRITICAL 9.8: websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1https://patchthecve.com/cve/CVE-2021-33254.htmlhttps://patchthecve.com/cve/CVE-2021-33254.htmlWed, 17 Jun 2026 03:54:23 +0000HIGH 7.5: An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function.https://patchthecve.com/cve/CVE-2021-43298.htmlhttps://patchthecve.com/cve/CVE-2021-43298.htmlWed, 17 Jun 2026 04:10:48 +0000CRITICAL 9.8: The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until thhttps://patchthecve.com/cve/CVE-2021-42342.htmlhttps://patchthecve.com/cve/CVE-2021-42342.htmlWed, 17 Jun 2026 04:09:40 +0000CRITICAL 9.8: An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.https://patchthecve.com/cve/CVE-2020-15688.htmlhttps://patchthecve.com/cve/CVE-2020-15688.htmlWed, 17 Jun 2026 02:57:03 +0000HIGH 8.8: The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.https://patchthecve.com/cve/CVE-2020-15689.htmlhttps://patchthecve.com/cve/CVE-2020-15689.htmlWed, 17 Jun 2026 02:57:03 +0000HIGH 7.5: Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.