Week 47, 2021
22–28 November 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.1 EPSS 52%
- Critical 9.1 EPSS 6.4%
- Critical 9.8 EPSS 2.4%
- Critical 9.1 EPSS 2.2%
-
Critical 9.0
CVE-2021-3554 Improper Access Control vulnerability in the patchesUpdate APIEPSS 2.1%
Bitdefender · GravityZone · Endpoint Security Tools for Linux · Unified Endpoint
-
Critical 9.1
CVE-2021-36313 Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu…EPSS 2.1%
- Critical 9.0 EPSS 1.9%
- Critical 9.8 EPSS 1.5%
- Critical 9.1 EPSS 1.2%
-
Critical 9.1
CVE-2021-36312 Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-co…EPSS 1.1%
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.8 EPSS 39%
-
High 8.8
CVE-2021-38003 Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p…EPSS 39%
-
Medium 6.5
CVE-2021-36300 iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnera…EPSS 33%
-
High 7.1
CVE-2021-36299 Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user…EPSS 30%
-
High 8.1
CVE-2021-44223 WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain att…EPSS 29%
- Unscored EPSS 29%
-
Medium 5.9
CVE-2021-36301 Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker ma…EPSS 28%
-
Unscored
CVE-2021-38001 Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 27%
Advisories
- SUSE / openSUSE Security Updates 31
- Debian Security (DSA / DLA) 101 critical
- Oracle Linux Security Advisories (ELSA) 8
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 5
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- CISA ICS & IT advisories 1
- DSA-5013-1 roundcube - security update 2 CVEs