Total
420746 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-33199 | 1 Expressionengine | 1 Expressionengine | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg. | |||||
| CVE-2021-33198 | 1 Golang | 1 Go | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. | |||||
| CVE-2021-33197 | 1 Golang | 1 Go | 2026-06-17 | 4.3 MEDIUM | 5.3 MEDIUM |
| In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. | |||||
| CVE-2021-33196 | 2 Debian, Golang | 2 Debian Linux, Go | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. | |||||
| CVE-2021-33195 | 2 Golang, Netapp | 2 Go, Cloud Insights Telegraf Agent | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. | |||||
| CVE-2021-33194 | 2 Fedoraproject, Golang | 2 Fedora, Go | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. | |||||
| CVE-2021-33193 | 5 Apache, Debian, Fedoraproject and 2 more | 6 Http Server, Debian Linux, Fedora and 3 more | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48. | |||||
| CVE-2021-33192 | 1 Apache | 1 Jena Fuseki | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive). | |||||
| CVE-2021-33191 | 1 Apache | 1 Nifi Minifi C\+\+ | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0 | |||||
| CVE-2021-33190 | 1 Apache | 1 Apisix Dashboard | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1 | |||||
| CVE-2021-33186 | 1 Serenityos | 1 Serenityos | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. | |||||
| CVE-2021-33185 | 1 Serenityos | 1 Serenityos | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information. | |||||
| CVE-2021-33184 | 1 Synology | 1 Download Station | 2026-06-17 | 4.0 MEDIUM | 7.7 HIGH |
| Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors. | |||||
| CVE-2021-33183 | 1 Synology | 1 Docker | 2026-06-17 | 3.6 LOW | 7.9 HIGH |
| Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors. | |||||
| CVE-2021-33182 | 1 Synology | 1 Diskstation Manager | 2026-06-17 | 4.0 MEDIUM | 5.0 MEDIUM |
| Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. | |||||
| CVE-2021-33181 | 1 Synology | 1 Video Station | 2026-06-17 | 6.5 MEDIUM | 6.6 MEDIUM |
| Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors. | |||||
| CVE-2021-33180 | 1 Synology | 1 Media Server | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2021-33179 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload. | |||||
| CVE-2021-33178 | 1 Nagvis | 1 Nagvis | 2026-06-17 | 8.5 HIGH | 6.5 MEDIUM |
| The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system. | |||||
| CVE-2021-33177 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries. | |||||