Week 21, 2021

24–30 May 2021

New CVEs: 408
Critical: 22
High: 43
Newly exploited: 0
Advisories: 145
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-21985 The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab…
EPSS 100%
Critical 9.8
CVE-2021-33564 Dragonfly contains remote code execution vulnerability
EPSS 72%
Critical 9.8
CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Software Foundation · Apache Dubbo

EPSS 61%
Critical 9.8
CVE-2021-22160 Authentication with JWT allows use of “none”-algorithm
Apache Software Foundation · Apache Pulsar

EPSS 53%
Critical 9.8
CVE-2021-27852 Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This…
Checkbox · Survey

EPSS 30%
Critical 9.8
CVE-2021-25641 Dubbo Zookeeper does not check serialization id
Apache Software Foundation · Apache Dubbo

EPSS 21%
Critical 9.8
CVE-2020-15782 A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS va…
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) · SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) · SIMATIC S7-1200 CPU family (incl. SIPLUS variants)

EPSS 5.2%
Critical 9.8
CVE-2021-29300 Command Injection in @ronomon/opened
EPSS 4.5%
Critical 9.8
CVE-2021-25946 Prototype pollution in nconf-toml
EPSS 3.3%
Critical 9.8
CVE-2021-25945 Prototype pollution vulnerability in js-extend
EPSS 3%
Critical 9.8
CVE-2021-25944 deep-defaults vulnerable to prototype pollution
EPSS 3%
Critical 9.8
CVE-2021-33575 Remote code execution in ruby-jss
EPSS 2.6%
Critical 10.0
CVE-2021-32637 Authentication bypassed with malformed request URI
authelia · authelia

EPSS 2.2%
Critical 9.1
CVE-2021-33497 Path Traversal in Dutchcoders transfer.sh
EPSS 2%
Critical 9.1
CVE-2021-21658 XML external entity vulnerability in Jenkins Nuget Plugin
Jenkins Project · Jenkins Nuget Plugin

EPSS 1.5%

All 22 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ICSA-21-147-03 MesaLabs AmegaView 5 CVEs
DSA-4923-1 webkit2gtk - security update 4 CVEs
ICSA-21-147-01 GENIVI Alliance DLT 1 CVEs