Week 34, 2021
23–29 August 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 88%
-
Critical 10.0
CVE-2021-33885 An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the …EPSS 5.6%
- Critical 9.8 EPSS 4.3%
- Critical 9.6 EPSS 1.9%
- Critical 9.6 EPSS 1.7%
- Critical 10.0 EPSS 1.6%
- Critical 10.0 EPSS 1.6%
-
Critical 9.1
CVE-2021-1577 Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write VulnerabilityEPSS 1.3%
Cisco · Cisco Application Policy Infrastructure Controller (APIC)
- Critical 9.1 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.5 EPSS 98%
- High 8.2 EPSS 91%
-
High 7.8
CVE-2021-30860 An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big…EPSS 76%
-
Unscored
CVE-2021-37538 Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL c…EPSS 74%
-
High 8.7
CVE-2021-22242 Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerabili…EPSS 64%
- High 7.4 EPSS 48%
-
High 7.8
CVE-2021-28554 Adobe Acrobat Reader DC Path Parsing Out-Of-Bounds Read could lead to arbitrary code executionEPSS 46%
-
Unscored
CVE-2021-39608 Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php…EPSS 46%
Advisories
- SUSE / openSUSE Security Updates 635 critical
- Ubuntu Security Notices (USN) 81 critical
- Debian Security (DSA / DLA) 71 critical
- CISA ICS & IT advisories 72 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 2
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- ICSA-21-238-03 Delta Electronics DIAEnergie (Update C) 13 CVEs
- openSUSE-SU-2021:1188-1 Security update for openssl-1_1 2 CVEs
- USN-5051-1 openssl vulnerabilities 2 CVEs
- SUSE-SU-2021:2833-1 Security update for openssl-1_1 2 CVEs
- openSUSE-SU-2021:2830-1 Security update for openssl-1_1 2 CVEs
- SUSE-SU-2021:2830-1 Security update for openssl-1_1 2 CVEs
- DSA-4963-1 openssl - security update 2 CVEs
- ICSA-21-238-02 Annke Network Video Recorder 1 CVEs
- SUSE-SU-2021:2818-1 Security update for python-PyYAML 1 CVEs