https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-33840.htmlhttps://patchthecve.com/cve/CVE-2021-33840.htmlWed, 17 Jun 2026 03:55:17 +0000HIGH 7.5: The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature.https://patchthecve.com/cve/CVE-2021-33839.htmlhttps://patchthecve.com/cve/CVE-2021-33839.htmlWed, 17 Jun 2026 03:55:17 +0000HIGH 7.5: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.https://patchthecve.com/cve/CVE-2021-33838.htmlhttps://patchthecve.com/cve/CVE-2021-33838.htmlWed, 17 Jun 2026 03:55:17 +0000HIGH 7.5: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.