Total
420947 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-37304 | 1 Jeecg | 1 Jeecg | 2026-06-17 | N/A | 7.5 HIGH |
| An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface. | |||||
| CVE-2021-37289 | 1 Planex | 2 Mzk-dp150n, Mzk-dp150n Firmware | 2026-06-17 | N/A | 7.2 HIGH |
| Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp. | |||||
| CVE-2021-37274 | 1 Kingdee | 1 Kis Cloud | 2026-06-17 | 8.5 HIGH | 8.8 HIGH |
| Kingdee KIS Professional Edition has a privilege escalation vulnerability. Attackers can use the vulnerability to gain computer administrator rights via unspecified loopholes. | |||||
| CVE-2021-37273 | 1 Chinatelecom | 2 Epon Tianyi Gateway Zxhn F450, Epon Tianyi Gateway Zxhn F450 Firmware | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gateway is a hardware terminal of "Optical Modem Smart Router." Attackers can use this vulnerability to restart the device multiple times. | |||||
| CVE-2021-37271 | 1 Baidu | 1 Ueditor | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information. | |||||
| CVE-2021-37270 | 1 S-cms | 1 Cms Enterprise Website Construction System | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority. | |||||
| CVE-2021-37267 | 1 Kindsoft | 1 Kindeditor | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information. | |||||
| CVE-2021-37262 | 1 Jflyfox | 1 Jfinal Cms | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. | |||||
| CVE-2021-37254 | 1 M-files | 1 M-files Web | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server. | |||||
| CVE-2021-37253 | 1 M-files | 1 M-files Web | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application | |||||
| CVE-2021-37234 | 1 Modern Honey Network Project | 1 Modern Honey Network | 2026-06-17 | N/A | 6.5 MEDIUM |
| Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API. | |||||
| CVE-2021-37232 | 1 Atomicparsley Project | 1 Atomicparsley | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64. | |||||
| CVE-2021-37231 | 1 Atomicparsley Project | 1 Atomicparsley | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check. | |||||
| CVE-2021-37222 | 1 Rcdcap Project | 1 Rcdcap | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via specially crafted packets. | |||||
| CVE-2021-37221 | 1 Customer Relationship Management System Project | 1 Customer Relationship Management System | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which could let a remote malicious user upload an arbitrary php file. . | |||||
| CVE-2021-37220 | 2 Artifex, Fedoraproject | 2 Mupdf, Fedora | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, for example, be seen with crafted "mutool draw" input. | |||||
| CVE-2021-37219 | 1 Hashicorp | 1 Consul | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. | |||||
| CVE-2021-37218 | 1 Hashicorp | 1 Nomad | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4. | |||||
| CVE-2021-37216 | 1 Qsan | 4 Xn8008t, Xn8008t Firmware, Xn8024r and 1 more | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data. | |||||
| CVE-2021-37215 | 1 Larvata | 1 Flygo | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter. | |||||