Ritlabs
Ritlabs Tinyweb: vulnerabilidades y CVE
Ritlabs Tinyweb tiene 8 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE8
Últimos 12 meses6
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-29046 | Crítica (9.2) | 0.56% | — | 6 mar 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly… |
| CVE-2026-28497 | Crítica (9.3) | 0.67% | — | 6 mar 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to… |
| CVE-2026-27633 | Alta (8.7) | 0.82% | — | 26 feb 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhaustion. Unauthenticated remote attackers can send an HTTP… |
| CVE-2026-27630 | Alta (8.7) | 0.82% | — | 26 feb 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every… |
| CVE-2026-27613 | Crítica (10) | 1.4% | — | 25 feb 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending… |
| CVE-2026-22781 | Crítica (10) | 2.5% | — | 12 ene 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as… |
| CVE-2024-5193 | Media (5.5) | 0.66% | — | 22 may 2024 | A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is… |
| CVE-2024-34199 | Alta (8.6) | 1.2% | — | 14 may 2024 | TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements in the request line. |