Week 9, 2021

1–7 March 2021

New CVEs: 261
Critical: 26
High: 32
Newly exploited: 0
Advisories: 97
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19

EPSS 100%
Critical 9.8
CVE-2021-22681 Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communi…
EPSS 64%
Critical 9.8
CVE-2020-24913 qcubed SQL injection vulnerability in profile.php via the strQuery parameter
EPSS 41%
Critical 9.1
CVE-2021-26412 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 19 · Microsoft Exchange Server 2019 Cumulative Update 8

EPSS 29%
Critical 9.1
CVE-2021-27078 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 19 · Microsoft Exchange Server 2019 Cumulative Update 8

EPSS 18%
Critical 9.8
CVE-2020-8298 Command injection in fs-path
EPSS 11%
Critical 9.8
CVE-2020-24914 qcubed PHP object injection
EPSS 5%
Critical 9.8
CVE-2021-23344 Remote Code Execution (RCE)
EPSS 4.9%
Critical 9.8
CVE-2021-25914 Prototype Pollution Vulnerability in object-collider
EPSS 3.7%
Critical 10.0
CVE-2020-35636 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface()…
EPSS 3.4%
Critical 10.0
CVE-2020-28601 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_pars…
EPSS 3%
Critical 10.0
CVE-2020-35628 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa…
EPSS 2.9%
Critical 10.0
CVE-2020-28636 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa…
EPSS 2.9%
Critical 9.8
CVE-2021-25315 salt-api unauthenticated remote code execution
SUSE · openSUSE · Tumbleweed · SUSE Linux Enterprise Server 15 SP 3

EPSS 2.3%
Critical 10.0
CVE-2021-21321 Prefix escape
fastify · fastify-reply-from

EPSS 1.8%

All 26 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

SUSE-SU-2021:0696-1 Security update for python-cryptography 1 CVEs
USN-4754-4 python2.7 vulnerability 1 CVEs
SUSE-SU-2021:0675-1 Security update for python-cryptography 1 CVEs
MSRC-CVE-2021-26412 Microsoft Exchange Server Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-27065 Microsoft Exchange Server Remote Code Execution Vulnerability 1 CVEs
SUSE-SU-2021:0669-1 Security update for python-cryptography 1 CVEs
SUSE-SU-2021:0668-1 Security update for python-cryptography 1 CVEs