diff --git a/2020/13xxx/CVE-2020-13936.json b/2020/13xxx/CVE-2020-13936.json
index cb0b7e74871..43d86d58dbf 100644
--- a/2020/13xxx/CVE-2020-13936.json
+++ b/2020/13xxx/CVE-2020-13936.json
@@ -134,6 +134,16 @@
                 "refsource": "MLIST",
                 "name": "[ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)",
                 "url": "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E"
+            },
+            {
+                "refsource": "MLIST",
+                "name": "[ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)",
+                "url": "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E"
+            },
+            {
+                "refsource": "MLIST",
+                "name": "[ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)",
+                "url": "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E"
             }
         ]
     },
diff --git a/2020/25xxx/CVE-2020-25649.json b/2020/25xxx/CVE-2020-25649.json
index f25e7f8ff08..433ddbdacb8 100644
--- a/2020/25xxx/CVE-2020-25649.json
+++ b/2020/25xxx/CVE-2020-25649.json
@@ -298,6 +298,16 @@
                 "refsource": "MLIST",
                 "name": "[iotdb-reviews] 20210324 [GitHub] [iotdb] wangchao316 closed pull request #2896: [IOTDB-1256] Jackson have loopholes CVE-2020-25649",
                 "url": "https://lists.apache.org/thread.html/r7cb5b4b3e4bd41a8042e5725b7285877a17bcbf07f4eb3f7b316af60@%3Creviews.iotdb.apache.org%3E"
+            },
+            {
+                "refsource": "MLIST",
+                "name": "[iotdb-commits] 20210325 [iotdb] branch master updated: [IOTDB-1256] upgrade Jackson to 2.11.0 because of loopholes CVE-2020-25649 (#2896)",
+                "url": "https://lists.apache.org/thread.html/r73bef1bb601a9f093f915f8075eb49fcca51efade57b817afd5def07@%3Ccommits.iotdb.apache.org%3E"
+            },
+            {
+                "refsource": "MLIST",
+                "name": "[iotdb-reviews] 20210325 [GitHub] [iotdb] jixuan1989 merged pull request #2896: [IOTDB-1256] Jackson have loopholes CVE-2020-25649",
+                "url": "https://lists.apache.org/thread.html/r6cbd599b80e787f02ff7a1391d9278a03f37d6a6f4f943f0f01a62fb@%3Creviews.iotdb.apache.org%3E"
             }
         ]
     },
diff --git a/2021/26xxx/CVE-2021-26715.json b/2021/26xxx/CVE-2021-26715.json
index 8956a0bc913..385ee6439b7 100644
--- a/2021/26xxx/CVE-2021-26715.json
+++ b/2021/26xxx/CVE-2021-26715.json
@@ -1,17 +1,66 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
-        "ID": "CVE-2021-26715",
         "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "ID": "CVE-2021-26715",
+        "STATE": "PUBLIC"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "n/a",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "n/a"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "n/a"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network."
+            }
+        ]
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "n/a"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "url": "https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases",
+                "refsource": "MISC",
+                "name": "https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases"
+            },
+            {
+                "refsource": "MISC",
+                "name": "https://portswigger.net/research/hidden-oauth-attack-vectors",
+                "url": "https://portswigger.net/research/hidden-oauth-attack-vectors"
             }
         ]
     }
diff --git a/2021/27xxx/CVE-2021-27582.json b/2021/27xxx/CVE-2021-27582.json
index 79431a2e2d7..3a662bde41c 100644
--- a/2021/27xxx/CVE-2021-27582.json
+++ b/2021/27xxx/CVE-2021-27582.json
@@ -61,6 +61,11 @@
                 "url": "http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html",
                 "refsource": "MISC",
                 "name": "http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html"
+            },
+            {
+                "refsource": "MISC",
+                "name": "https://portswigger.net/research/hidden-oauth-attack-vectors",
+                "url": "https://portswigger.net/research/hidden-oauth-attack-vectors"
             }
         ]
     }
diff --git a/2021/29xxx/CVE-2021-29156.json b/2021/29xxx/CVE-2021-29156.json
new file mode 100644
index 00000000000..cdcb7cc1513
--- /dev/null
+++ b/2021/29xxx/CVE-2021-29156.json
@@ -0,0 +1,67 @@
+{
+    "CVE_data_meta": {
+        "ASSIGNER": "cve@mitre.org",
+        "ID": "CVE-2021-29156",
+        "STATE": "PUBLIC"
+    },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "n/a",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "n/a"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "n/a"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key."
+            }
+        ]
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "n/a"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "url": "https://portswigger.net/research/hidden-oauth-attack-vectors",
+                "refsource": "MISC",
+                "name": "https://portswigger.net/research/hidden-oauth-attack-vectors"
+            },
+            {
+                "url": "https://bugster.forgerock.org/jira/browse/OPENAM-10135",
+                "refsource": "MISC",
+                "name": "https://bugster.forgerock.org/jira/browse/OPENAM-10135"
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/2021/29xxx/CVE-2021-29157.json b/2021/29xxx/CVE-2021-29157.json
new file mode 100644
index 00000000000..470b4b4ab9f
--- /dev/null
+++ b/2021/29xxx/CVE-2021-29157.json
@@ -0,0 +1,18 @@
+{
+    "data_type": "CVE",
+    "data_format": "MITRE",
+    "data_version": "4.0",
+    "CVE_data_meta": {
+        "ID": "CVE-2021-29157",
+        "ASSIGNER": "cve@mitre.org",
+        "STATE": "RESERVED"
+    },
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/2021/29xxx/CVE-2021-29158.json b/2021/29xxx/CVE-2021-29158.json
new file mode 100644
index 00000000000..1833e2a1818
--- /dev/null
+++ b/2021/29xxx/CVE-2021-29158.json
@@ -0,0 +1,18 @@
+{
+    "data_type": "CVE",
+    "data_format": "MITRE",
+    "data_version": "4.0",
+    "CVE_data_meta": {
+        "ID": "CVE-2021-29158",
+        "ASSIGNER": "cve@mitre.org",
+        "STATE": "RESERVED"
+    },
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/2021/29xxx/CVE-2021-29159.json b/2021/29xxx/CVE-2021-29159.json
new file mode 100644
index 00000000000..35b72add20f
--- /dev/null
+++ b/2021/29xxx/CVE-2021-29159.json
@@ -0,0 +1,18 @@
+{
+    "data_type": "CVE",
+    "data_format": "MITRE",
+    "data_version": "4.0",
+    "CVE_data_meta": {
+        "ID": "CVE-2021-29159",
+        "ASSIGNER": "cve@mitre.org",
+        "STATE": "RESERVED"
+    },
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+            }
+        ]
+    }
+}
\ No newline at end of file