Total
421097 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-3239 | 1 E-learning System Project | 1 E-learning System | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell. | |||||
| CVE-2021-3236 | 1 Vim | 1 Vim | 2026-06-17 | N/A | 5.5 MEDIUM |
| vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method. | |||||
| CVE-2021-3229 | 1 Asus | 2 Rt-ax3000, Rt-ax3000 Firmware | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error. | |||||
| CVE-2021-3224 | 1 Cszcms | 1 Csz Cms | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter. | |||||
| CVE-2021-3223 | 1 Nodered | 1 Node-red-dashboard | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. | |||||
| CVE-2021-3210 | 1 Bloodhound Project | 1 Bloodhound | 2026-06-17 | 9.3 HIGH | 9.6 CRITICAL |
| components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter. | |||||
| CVE-2021-3204 | 1 Webware | 1 Webdesktop | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. | |||||
| CVE-2021-3200 | 2 Opensuse, Oracle | 2 Libsolv, Communications Cloud Native Core Policy | 2026-06-17 | 4.3 MEDIUM | 3.3 LOW |
| Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service | |||||
| CVE-2021-3198 | 1 Ivanti | 1 Mobileiron | 2026-06-17 | 9.0 HIGH | 6.5 MEDIUM |
| By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0. | |||||
| CVE-2021-3197 | 3 Debian, Fedoraproject, Saltstack | 3 Debian Linux, Fedora, Salt | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. | |||||
| CVE-2021-3196 | 1 Hitachi | 1 Id Bravura Security Fabric | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management (authenticating via SAML through a third-party identity provider), an attacker can inject additional data into a signed SAML response being transmitted to the service provider (ID Bravura Security Fabric). The application successfully validates the signed values but uses the unsigned malicious values. An attacker with lower-privilege access to the application can inject the username of a high-privilege user to impersonate that user. | |||||
| CVE-2021-3195 | 1 Bitcoin | 1 Bitcoin Core | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions | |||||
| CVE-2021-3193 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user. | |||||
| CVE-2021-3191 | 1 Hpe | 2 Nonstop, Web Viewpoint | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows Remote Unauthorized Access for T0320L01^ABY and T0320L01^ACD, T0952L01^AAR through T0952L01^AAX, and T0986L01^AAD through T0986L01^AAJ (L) and T0320H01^ABW through T0320H01^ACC, T0952H01^AAQ through T0952H01^AAW, and T0986H01^AAC through T0986H01^AAI (J and H). | |||||
| CVE-2021-3190 | 1 Async-git Project | 1 Async-git | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. | |||||
| CVE-2021-3189 | 1 Google | 1 Slashify | 2026-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. | |||||
| CVE-2021-3188 | 1 Phplist | 1 Phplist | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. | |||||
| CVE-2021-3187 | 2 Apple, Beyondtrust | 2 Mac Os X, Privilege Management For Mac | 2026-06-17 | N/A | 8.8 HIGH |
| An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicious script (that executes as root from a temporary directory) during install time. (This applies to macOS before 10.15.5, or Security Update 2020-003 on Mojave and High Sierra, Later versions of macOS are not vulnerable.) | |||||
| CVE-2021-3186 | 1 Tenda | 2 Ac5, Ac5 Firmware | 2026-06-17 | 4.3 MEDIUM | 5.4 MEDIUM |
| A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter. | |||||
| CVE-2021-3185 | 1 Freedesktop | 1 Gst-plugins-bad | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution. | |||||