Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-37850 | 1 Eset | 3 Cyber Security, Endpoint Antivirus, Endpoint Security | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot. | |||||
| CVE-2021-37847 | 1 Pengutronix | 1 Barebox | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. | |||||
| CVE-2021-37845 | 1 Citadel | 1 Webcit | 2026-06-17 | N/A | 3.7 LOW |
| An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior. | |||||
| CVE-2021-37840 | 1 Aapanel | 1 Aapanel | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome). | |||||
| CVE-2021-37774 | 1 Tp-link | 2 Tl-wdr7660, Tl-wdr7660 Firmware | 2026-06-17 | N/A | 8.0 HIGH |
| An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code. | |||||
| CVE-2021-37740 | 1 Mdt | 4 Scn-ip000.03, Scn-ip000.03 Firmware, Scn-ip100.03 and 1 more | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 before v3.0.4, that allows a remote attacker to turn the device unresponsive to all requests on the KNXnet/IP Secure layer, until the device is rebooted, via a SESSION_REQUEST frame with a modified total length field. | |||||
| CVE-2021-37736 | 1 Arubanetworks | 1 Clearpass Policy Manager | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability. | |||||
| CVE-2021-37707 | 1 Shopware | 1 Shopware | 2026-06-17 | 5.0 MEDIUM | 6.5 MEDIUM |
| Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | |||||
| CVE-2021-37697 | 1 Tmerc-cogs Project | 1 Tmerc-cogs | 2026-06-17 | 4.0 MEDIUM | 7.1 HIGH |
| tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog. | |||||
| CVE-2021-37696 | 1 Tmerc-cogs Project | 1 Tmerc-cogs | 2026-06-17 | 4.0 MEDIUM | 7.1 HIGH |
| tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific MassDM message. Issue is patched in commit 92325be650a6c17940cc52611797533ed95dbbe1. All users are advised to update to the current commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command. | |||||
| CVE-2021-37613 | 1 Stormshield | 1 Stormshield Network Security | 2026-06-17 | 2.9 LOW | 6.5 MEDIUM |
| Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service. | |||||
| CVE-2021-37554 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions. | |||||
| CVE-2021-37549 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. | |||||
| CVE-2021-37547 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made. | |||||
| CVE-2021-37543 | 1 Jetbrains | 1 Rubymine | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects. | |||||
| CVE-2021-37540 | 1 Jetbrains | 1 Hub | 2026-06-17 | 6.4 MEDIUM | 6.5 MEDIUM |
| In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. | |||||
| CVE-2021-37436 | 1 Amazon | 2 Echo Dot, Echo Dot Firmware | 2026-06-17 | 1.9 LOW | 4.2 MEDIUM |
| Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing personal content via a factory reset. Also, the vendor has reportedly indicated that they are working on mitigations. | |||||
| CVE-2021-37424 | 1 Zohocorp | 1 Manageengine Admanager Plus | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. | |||||
| CVE-2021-37423 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. | |||||
| CVE-2021-37384 | 1 Furukawa | 8 423-41w\/ac, 423-41w\/ac Firmware, Ld420-10r and 5 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface. | |||||