Total
420785 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-34215 | 1 Totolink | 2 A3002r, A3002r Firmware | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field. | |||||
| CVE-2021-34207 | 1 Totolink | 2 A3002r, A3002r Firmware | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field. | |||||
| CVE-2021-34193 | 1 Opensc Project | 1 Opensc | 2026-06-17 | N/A | 7.5 HIGH |
| Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs. | |||||
| CVE-2021-34190 | 1 Issabel | 1 Pbx | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Name" or "Prefix" fields under the "Create New Rate" module. | |||||
| CVE-2021-34187 | 1 Chamilo | 1 Chamilo | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. | |||||
| CVE-2021-34185 | 1 Mackron | 1 Miniaudio | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h | |||||
| CVE-2021-34184 | 1 Mackron | 1 Miniaudio | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h. | |||||
| CVE-2021-34182 | 1 Ttyd Project | 1 Ttyd | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. | |||||
| CVE-2021-34181 | 1 Tomexam | 1 Tomexam | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml. | |||||
| CVE-2021-34174 | 1 Broadcom | 4 Bcm4352, Bcm4352 Firmware, Bcm43684 and 1 more | 2026-06-17 | 4.9 MEDIUM | 4.6 MEDIUM |
| A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. Any wireless router using BCM4352 and BCM43684 will be affected, such as ASUS AX6100. An attacker may cause a Denial of Service (DoS) to any device connected to BCM4352 or BCM43684 routers via an association or reassociation frame. | |||||
| CVE-2021-34173 | 1 Espressif | 2 Esp32, Esp32 Firmware | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. The device requires a reboot to recover. | |||||
| CVE-2021-34170 | 1 Fromsoftware | 1 Dark Souls Iii | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code. | |||||
| CVE-2021-34167 | 1 Taogogo | 1 Taocms | 2026-06-17 | N/A | 8.8 HIGH |
| Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php. | |||||
| CVE-2021-34166 | 1 Simple Food Website Project | 1 Simple Food Website | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin. | |||||
| CVE-2021-34165 | 1 Basic Shopping Cart Project | 1 Basic Shopping Cart | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin. | |||||
| CVE-2021-34164 | 1 Lizhifaka Project | 1 Lizhifaka | 2026-06-17 | N/A | 8.8 HIGH |
| Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/email location. | |||||
| CVE-2021-34150 | 1 Bluetrum | 2 Ab5301a, Ab5301a Firmware | 2026-06-17 | 3.3 LOW | 6.5 MEDIUM |
| The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity. | |||||
| CVE-2021-34149 | 1 Ti | 2 Cc256xcqfn-em, Cc256xcqfn-em Firmware | 2026-06-17 | 3.3 LOW | 6.5 MEDIUM |
| The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure. | |||||
| CVE-2021-34148 | 1 Cypress | 2 Cyw20735b1, Wireless Internet Connectivity For Embedded Devices | 2026-06-17 | 6.1 MEDIUM | 6.5 MEDIUM |
| The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet. | |||||
| CVE-2021-34147 | 1 Cypress | 2 Cyw20735b1, Wireless Internet Connectivity For Embedded Devices | 2026-06-17 | 6.1 MEDIUM | 6.5 MEDIUM |
| The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress. | |||||