Total
421097 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-3398 | 1 Stormshield | 1 Stormshield Network Security | 2026-06-17 | 5.0 MEDIUM | 5.8 MEDIUM |
| Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component. | |||||
| CVE-2021-3396 | 1 Opennms | 3 Horizon, Meridian, Newts | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions. | |||||
| CVE-2021-3395 | 1 Pryaniki | 1 Pryaniki | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment. | |||||
| CVE-2021-3394 | 1 Millewin | 1 Millewin | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation. | |||||
| CVE-2021-3393 | 2 Postgresql, Redhat | 3 Postgresql, Enterprise Linux, Software Collections | 2026-06-17 | 3.5 LOW | 4.3 MEDIUM |
| An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read. | |||||
| CVE-2021-3392 | 3 Debian, Fedoraproject, Qemu | 3 Debian Linux, Fedora, Qemu | 2026-06-17 | 2.1 LOW | 3.2 LOW |
| A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected. | |||||
| CVE-2021-3391 | 1 Mobileiron | 1 Mobile\@work | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message | |||||
| CVE-2021-3384 | 1 Stormshield | 1 Stormshield Network Security | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily prevent the system to contact new hosts via IPv4 or IPv6. This affects versions 2.0.0 to 2.7.7, 2.8.0 to 2.16.0, 3.0.0 to 3.7.16, 3.8.0 to 3.11.4, and 4.0.0 to 4.1.5. Fixed in versions 2.7.8, 3.7.17, 3.11.5, and 4.2.0. | |||||
| CVE-2021-3382 | 1 Gitea | 1 Gitea | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path. | |||||
| CVE-2021-3378 | 1 Fortilogger | 1 Fortilogger | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp. | |||||
| CVE-2021-3377 | 1 Ansi Up Project | 1 Ansi Up | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0. | |||||
| CVE-2021-3376 | 1 Cuppacms | 1 Cuppacms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter. | |||||
| CVE-2021-3375 | 1 Atomisystems | 1 Activepresenter | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution. | |||||
| CVE-2021-3374 | 1 Rstudio | 1 Shiny Server | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash. | |||||
| CVE-2021-3370 | 1 Douco | 1 Douphp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php. | |||||
| CVE-2021-3355 | 1 Lightcms Project | 1 Lightcms | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords. | |||||
| CVE-2021-3352 | 1 Mitel | 1 Micontact Center Business | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access (view and modify) user data without authorization due to improper handling of tokens. | |||||
| CVE-2021-3351 | 1 Openplcproject | 1 Openplc | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page. | |||||
| CVE-2021-3350 | 1 Delete Account Project | 1 Delete Account | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter. | |||||
| CVE-2021-3349 | 1 Gnome | 1 Evolution | 2026-06-17 | 2.1 LOW | 3.3 LOW |
| GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior | |||||