Total
419416 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25283 | 3 Debian, Fedoraproject, Saltstack | 3 Debian Linux, Fedora, Salt | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. | |||||
| CVE-2021-25282 | 3 Debian, Fedoraproject, Saltstack | 3 Debian Linux, Fedora, Salt | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. | |||||
| CVE-2021-25281 | 3 Debian, Fedoraproject, Saltstack | 3 Debian Linux, Fedora, Salt | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master. | |||||
| CVE-2021-25278 | 1 Ftapi | 1 Ftapi | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor. | |||||
| CVE-2021-25277 | 1 Ftapi | 1 Ftapi | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component. | |||||
| CVE-2021-25276 | 1 Solarwinds | 1 Serv-u | 2026-06-17 | 3.6 LOW | 7.1 HIGH |
| In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges. | |||||
| CVE-2021-25275 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 2.1 LOW | 7.8 HIGH |
| SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login details from that file, including the login name and its associated password. Then, the credentials can be used to get database owner access to the SWNetPerfMon.DB database. This gives access to the data collected by SolarWinds applications, and leads to admin access to the applications by inserting or changing authentication data stored in the Accounts table of the database. | |||||
| CVE-2021-25274 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem. | |||||
| CVE-2021-25273 | 1 Sophos | 1 Unified Threat Management | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. | |||||
| CVE-2021-25271 | 1 Sophos | 1 Hitmanpro | 2026-06-17 | 3.6 LOW | 6.0 MEDIUM |
| A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. | |||||
| CVE-2021-25270 | 1 Sophos | 1 Hitmanpro.alert | 2026-06-17 | 7.2 HIGH | 6.7 MEDIUM |
| A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. | |||||
| CVE-2021-25269 | 1 Sophos | 3 Exploit Prevention, Intercept X Endpoint, Intercept X For Server | 2026-06-17 | 2.1 LOW | 4.4 MEDIUM |
| A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3. | |||||
| CVE-2021-25268 | 1 Sophos | 2 Firewall, Firewall Firmware | 2026-06-17 | 6.0 MEDIUM | 8.4 HIGH |
| Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. | |||||
| CVE-2021-25267 | 1 Sophos | 2 Firewall, Firewall Firmware | 2026-06-17 | 8.5 HIGH | 6.8 MEDIUM |
| Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. | |||||
| CVE-2021-25266 | 1 Sophos | 2 Authenticator, Intercept X | 2026-06-17 | 2.1 LOW | 3.9 LOW |
| An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495. | |||||
| CVE-2021-25265 | 2 Microsoft, Sophos | 2 Windows, Connect | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| A malicious website could execute code remotely in Sophos Connect Client before version 2.1. | |||||
| CVE-2021-25264 | 1 Sophos | 2 Home, Intercept X | 2026-06-17 | 7.2 HIGH | 6.7 MEDIUM |
| In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. | |||||
| CVE-2021-25263 | 1 Yandex | 1 Yandex Browser | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with insecure permissions during Yandex Browser update process. | |||||
| CVE-2021-25262 | 2 Google, Yandex | 2 Android, Yandex Browser | 2026-06-17 | N/A | 5.4 MEDIUM |
| Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. | |||||
| CVE-2021-25261 | 2 Microsoft, Yandex | 2 Windows, Yandex Browser | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process. | |||||