Skip to content
OpenAdvisories

Archive

April 2021

Vulnerabilities first published in this month (UTC), newest first.

← March 2021 2021 / April May 2021 →
  1. 165
  2. 2178
  3. 31
  4. 4 
  5. 565
  6. 694
  7. 758
  8. 865
  9. 955
  10. 102
  11. 119
  12. 1261
  13. 13207
  14. 1480
  15. 1549
  16. 1619
  17. 174
  18. 188
  19. 1952
  20. 2030
  21. 2140
  22. 22297
  23. 2347
  24. 244
  25. 256
  26. 2668
  27. 2750
  28. 2859
  29. 29118
  30. 3050
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-27651 Public exploit Scanner template EPSS 54%

    In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to by…

    Pega Systems Pega Infinity
  • Critical 10.0
    CVE-2021-22205 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

    GitLab GitLab gitlab Web / CMS Ubuntu
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

    Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-26291 Public exploit

    block repositories using http by default

    Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…

    Apache Software Foundation Apache Maven org.apache.maven:maven-core maven Debian Ubuntu Maven
  • Critical 9.8
    CVE-2021-2302 Public exploit

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported…

    Oracle Platform Security for Java
  • Critical 9.8
    CVE-2020-2509 Exploited Public exploit EPSS 34%

    Command Injection Vulnerability in QTS and QuTS hero

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …

    QNAP Systems QTS QuTS hero
    KEV Apr 11, 2022
  • Critical 9.1
    CVE-2021-26830 Public exploit

    SQL Injection in tribalsystems/zenario

    SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.

    tribalsystems/zenario Packagist
  • Critical —
    CVE-2021-27850 Public exploit Scanner template EPSS 94%

    Bypass of the fix for CVE-2019-0195

    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Befor…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven
  • Critical 9.8
    CVE-2021-28480 Public exploit Scanner template EPSS 71%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
  • Critical 9.8
    CVE-2021-20021 Exploited · Ransomware Public exploit Scanner template EPSS 89%

    A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

    SonicWall Email Security Network devices
    KEV Nov 3, 2021
  • Critical 9.3
    CVE-2021-21425 Public exploit EPSS 80%

    Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

    Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Partic…

    getgrav grav-plugin-admin
  • Critical 9.6
    CVE-2021-22201 Public exploit

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file…

    GitLab GitLab gitlab Web / CMS Ubuntu