Week 35, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-26084 In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…

  Atlassian · Confluence Server · Confluence Data Center

  EPSS 100%
• Critical 9.8
  CVE-2021-37415 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
  EPSS 100%
• Critical 9.6
  CVE-2021-28550 Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution

  Adobe · Acrobat Reader

  EPSS 52%
• Critical 9.8
  CVE-2021-34646 Booster for WooCommerce <= 5.4.3 Authentication Bypass

  Pluggabl · Booster for WooCommcerce

  EPSS 51%
• Critical 9.8
  CVE-2021-34746 Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability

  Cisco · Cisco Enterprise NFV Infrastructure Software

  EPSS 18%
• Critical 9.8
  CVE-2019-10095 bash command injection in spark interpreter

  Apache Software Foundation · Apache Zeppelin

  EPSS 5.7%
• Critical 9.1
  CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 3.2%
• Critical 9.1
  CVE-2021-36033 Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.9%
• Critical 9.1
  CVE-2021-36040 Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.9%
• Critical 9.1
  CVE-2021-36025 Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.8%
• Critical 9.1
  CVE-2021-36035 Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.8%
• Critical 9.1
  CVE-2021-36024 Magento Commerce Improper Neutralization of Special Elements Used In A Command

  Adobe · Magento Commerce

  EPSS 2.7%
• Critical 9.1
  CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.7%
• Critical 9.1
  CVE-2021-36042 Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.5%
• Critical 9.1
  CVE-2021-36041 Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 2.4%

All 26 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.9
  CVE-2021-35216 Deserialization of Untrusted Data in Resource Controls Remote Code Execution

  SolarWinds · Patch Manager

  EPSS 81%
• High 8.9
  CVE-2021-35218 Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

  SolarWinds · Patch Manager

  EPSS 76%
• High 8.9
  CVE-2021-35215 ActionPluginBaseView Deserialization of Untrusted Data RCE

  SolarWinds · Orion Platform

  EPSS 70%
• High 8.8
  CVE-2021-28560 Adobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code execution

  Adobe · Acrobat Reader

  EPSS 67%
• High 7.5
  CVE-2021-39316 ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure

  ZoomIt · ZoomSounds - WordPress Wave Audio Player with Playlist

  EPSS 66%
• Unscored
  CVE-2021-36356 KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable…
  EPSS 54%
• Unscored
  CVE-2021-32955 Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.
  EPSS 37%
• Medium 5.3
  CVE-2021-38314 Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure

  Redux.io · Gutenberg Template Library & Redux Framework

  EPSS 29%