Total
420933 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-35971 | 1 Veeam | 1 Veeam Backup \& Replication | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. | |||||
| CVE-2021-35970 | 1 Voxmedia | 1 Coral Talk | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type. | |||||
| CVE-2021-35969 | 1 Pexip | 1 Infinity | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. | |||||
| CVE-2021-35968 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges. | |||||
| CVE-2021-35967 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in. | |||||
| CVE-2021-35966 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks. | |||||
| CVE-2021-35965 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in. | |||||
| CVE-2021-35964 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content. | |||||
| CVE-2021-35963 | 1 Learningdigital | 1 Orca Hcm | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks. | |||||
| CVE-2021-35962 | 1 Secom | 2 Door Access Control, Personnel Attendance System | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission. | |||||
| CVE-2021-35961 | 1 Secom | 1 Dr.id Access Control | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission. | |||||
| CVE-2021-35959 | 1 Plone | 1 Plone | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field. | |||||
| CVE-2021-35958 | 1 Google | 1 Tensorflow | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives | |||||
| CVE-2021-35957 | 1 Stormshield | 1 Endpoint Security | 2026-06-17 | 4.6 MEDIUM | 6.7 MEDIUM |
| Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs (in %WINDIR%\system32) with malicious ones. | |||||
| CVE-2021-35956 | 1 Akcp | 10 Sensorprobe2, Sensorprobe2 Firmware, Sensorprobe4 and 7 more | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields. | |||||
| CVE-2021-35955 | 1 Contao | 1 Contao | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7. | |||||
| CVE-2021-35954 | 1 Fastrack | 2 Reflex 2.0, Reflex 2.0 Firmware | 2026-06-17 | N/A | 8.1 HIGH |
| fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature. | |||||
| CVE-2021-35953 | 1 Fastrack | 2 Reflex 2.0, Reflex 2.0 Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last three bytes of a characteristic value. | |||||
| CVE-2021-35952 | 1 Fastrack | 2 Reflex 2.0, Reflex 2.0 Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017. | |||||
| CVE-2021-35951 | 1 Fastrack | 2 Reflex 2.0, Reflex 2.0 Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device. | |||||