Week 17, 2021

26 April – 2 May 2021

New CVEs: 346
Critical: 12
High: 67
Newly exploited: 0
Advisories: 100
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-20090 A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow un…
EPSS 100%
Critical 9.8
CVE-2021-27651 In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
Pega Systems · Pega Infinity

EPSS 54%
Critical 9.8
CVE-2021-25928 Prototype pollution in safe-obj
EPSS 3.4%
Critical 9.8
CVE-2021-25927 Prototype pollution in safe-flat
EPSS 3.3%
Critical 9.8
CVE-2020-36326 Object injection in PHPMailer/PHPMailer
EPSS 3.1%
Critical 9.0
CVE-2021-27648 Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote aut…
Synology · Synology Antivirus Essential

EPSS 2.8%
Critical 9.8
CVE-2021-30167 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication
MERIT LILIN ENT.CO.,LTD. · P2/Z2/P3/Z3 IP camera firmware

EPSS 2.4%
Critical 9.8
CVE-2021-29476 Insecure Deserialization of untrusted data in rmccue/requests
WordPress · Requests

EPSS 2.1%
Critical 9.8
CVE-2021-30168 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1
MERIT LILIN ENT.CO.,LTD. · P2/Z2/P3/Z3 IP camera firmware

EPSS 2.1%
Critical 9.4
CVE-2021-29483 wikiconfig API leaked private config variables set through ManageWiki
miraheze · ManageWiki

EPSS 1.2%
Critical 10.0
CVE-2021-29475 PDF export allows arbitrary file reads
hedgedoc · hedgedoc

EPSS 1.2%
Critical
CVE-2021-30492 Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2021-21224 Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Google · Chrome

EPSS 84%
High 8.6
CVE-2021-29441 Authentication bypass
Alibaba · nacos

EPSS 83%
High 8.1
CVE-2021-25216 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
ISC · BIND9

EPSS 83%
Unscored
CVE-2021-30128 Unsafe deserialization in Apache OFBiz
Apache Software Foundation · Apache OFBiz

EPSS 81%
Unscored
CVE-2021-31856 A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles e…
EPSS 75%
High 8.8
CVE-2021-21220 Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a…
Google · Chrome

EPSS 70%
High 8.6
CVE-2021-29442 Authentication bypass
Alibaba · nacos

EPSS 64%
Medium 6.1
CVE-2021-28125 Apache Superset Open Redirect
Apache Software Foundation · Apache Superset

EPSS 64%

Advisories

ICSA-21-119-04 Multiple RTOS (Update E) 24 CVEs
openSUSE-SU-2021:0637-1 Security update for webkit2gtk3 10 CVEs
SUSE-SU-2021:1430-1 Security update for webkit2gtk3 10 CVEs
ICSA-21-119-01 Texas Instruments SimpleLink 5 CVEs
openSUSE-SU-2021:0634-1 Security update for librsvg 1 CVEs
openSUSE-SU-2021:0632-1 Security update for gsoap 1 CVEs
SUSE-SU-2021:1408-1 Security update for librsvg 1 CVEs