Total
419455 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-26032 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors. | |||||
| CVE-2021-26031 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI. | |||||
| CVE-2021-26030 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page | |||||
| CVE-2021-26029 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field. | |||||
| CVE-2021-26028 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path. | |||||
| CVE-2021-26027 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article. | |||||
| CVE-2021-26026 | 1 Acdsee | 1 Photo Studio 2021 | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a crafted BMP image. | |||||
| CVE-2021-26025 | 1 Acdsee | 1 Photo Studio 2021 | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image. | |||||
| CVE-2021-26024 | 1 Nagios | 2 Favorites, Nagios Xi | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account. | |||||
| CVE-2021-26023 | 1 Nagios | 2 Favorites, Nagios Xi | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. | |||||
| CVE-2021-25994 | 1 Userfrosting | 1 Userfrosting | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account. | |||||
| CVE-2021-25993 | 1 Requarks | 1 Wiki.js | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim. | |||||
| CVE-2021-25992 | 1 If-me | 1 Ifme | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. | |||||
| CVE-2021-25991 | 1 If-me | 1 Ifme | 2026-06-17 | 4.9 MEDIUM | 5.7 MEDIUM |
| In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme. | |||||
| CVE-2021-25990 | 1 If-me | 1 Ifme | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe. | |||||
| CVE-2021-25989 | 1 If-me | 1 Ifme | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them. | |||||
| CVE-2021-25988 | 1 If-me | 1 Ifme | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin. | |||||
| CVE-2021-25987 | 1 Hexo | 1 Hexo | 2026-06-17 | 1.9 LOW | 5.0 MEDIUM |
| Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code. | |||||
| CVE-2021-25986 | 1 Django-wiki Project | 1 Django-wiki | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript. | |||||
| CVE-2021-25985 | 1 Darwin | 1 Factor | 2026-06-17 | 7.5 HIGH | 7.8 HIGH |
| In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover. | |||||