Week 16, 2021

19–25 April 2021

New CVEs: 476
Critical: 26
High: 154
Newly exploited: 0
Advisories: 101
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2021-22205 An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fi…
GitLab · GitLab

EPSS 100%
Critical 10.0
CVE-2021-22893 Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure …
EPSS 48%
Critical 9.1
CVE-2021-26291 block repositories using http by default
Apache Software Foundation · Apache Maven

EPSS 8.7%
Critical 9.8
CVE-2021-2135 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2…
Oracle · WebLogic Server

EPSS 8.4%
Critical 9.8
CVE-2021-2302 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported versions that are affected are 11.1.1.9…
Oracle · Platform Security for Java

EPSS 5.7%
Critical 9.8
CVE-2021-20991 Fibaro Home Center Authenticated remote command execution
Fibar Group · Fibaro Home Center

EPSS 5.6%
Critical 9.8
CVE-2021-0254 Junos OS: Remote code execution vulnerability in overlayd service
Juniper Networks · Junos OS

EPSS 2.7%
Critical 10.0
CVE-2021-2248 Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily e…
Oracle · Secure Global Desktop

EPSS 2.5%
Critical 10.0
CVE-2021-2177 Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway). The supported version that is affected is 5.6. Easily …
Oracle · Secure Global Desktop

EPSS 2.5%
Critical 9.8
CVE-2021-2136 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.…
Oracle · WebLogic Server

EPSS 2.2%
Critical 9.4
CVE-2021-31597 Improper Certificate Validation in xmlhttprequest-ssl
EPSS 2%
Critical 9.6
CVE-2021-2221 Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily e…
Oracle · Secure Global Desktop

EPSS 2%
Critical 10.0
CVE-2021-2244 Vulnerability in the Hyperion Analytic Provider Services product of Oracle Hyperion (component: JAPI) and Essbase Analytic Provider Services product of Oracle …
Oracle · Hyperion Analytic Provider Services

EPSS 1.9%
Critical 10.0
CVE-2021-2317 Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supported version that …
Oracle · Cloud Infrastructure

EPSS 1.9%
Critical 10.0
CVE-2021-2256 Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supported version that is a…
Oracle · Cloud Infrastructure

EPSS 1.8%

All 26 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DLA-2635-1 libspring-java - security update 4 CVEs
SUSE-SU-2021:1310-1 Security update for librsvg 1 CVEs
ICSA-21-110-03 Delta Industrial Automation COMMGR 1 CVEs
USN-4919-1 openslp-dfsg vulnerability 1 CVEs