Total
421074 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-38619 | 1 Openbaraza | 1 Openbaraza Human Capital Management | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=). | |||||
| CVE-2021-38618 | 1 Gfos | 1 Workforce Management | 2026-06-17 | 6.8 MEDIUM | 7.4 HIGH |
| In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement. | |||||
| CVE-2021-38617 | 1 Eigentech | 1 Natural Language Processing | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation. | |||||
| CVE-2021-38616 | 1 Eigentech | 1 Natural Language Processing | 2026-06-17 | 6.5 MEDIUM | 7.6 HIGH |
| In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more. | |||||
| CVE-2021-38615 | 1 Eigentech | 1 Natural Language Processing | 2026-06-17 | 5.5 MEDIUM | 6.3 MEDIUM |
| In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information. | |||||
| CVE-2021-38614 | 1 Polipo Project | 1 Polipo | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | |||||
| CVE-2021-38613 | 1 Nascent | 1 Remkon Device Manager | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution. | |||||
| CVE-2021-38612 | 1 Nascent | 1 Remkon Device Manager | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL. | |||||
| CVE-2021-38611 | 1 Nascent | 1 Remkon Device Manager | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php. | |||||
| CVE-2021-38608 | 1 Tranquil | 1 Wapt | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent. | |||||
| CVE-2021-38607 | 1 Crocoblock | 1 Jetengine | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. | |||||
| CVE-2021-38606 | 1 Yogeshojha | 1 Rengine | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| reNgine through 0.5 relies on a predictable directory name. | |||||
| CVE-2021-38603 | 1 Pluxml | 1 Pluxml | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. | |||||
| CVE-2021-38602 | 1 Pluxml | 1 Pluxml | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. | |||||
| CVE-2021-38599 | 1 Wal-g Project | 1 Wal-g | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity." | |||||
| CVE-2021-38598 | 1 Openstack | 1 Neutron | 2026-06-17 | 5.8 MEDIUM | 9.1 CRITICAL |
| OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. | |||||
| CVE-2021-38597 | 1 Wolfssl | 1 Wolfssl | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. | |||||
| CVE-2021-38592 | 1 Wasm3 Project | 1 Wasm3 | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule). | |||||
| CVE-2021-38591 | 1 Google | 1 Android | 2026-06-17 | 2.1 LOW | 3.3 LOW |
| An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021). | |||||
| CVE-2021-38590 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | |||||