April 2021
1,970 CVEs published. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 22812% of the 1,837 with a CVSS score
- Added to CISA KEV
- 018 of this month's CVEs are in KEV, listed a median 208 days after publication
- Vendors
- 6873,136 products
- Top weakness
- XSSCWE-79 · 198 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Server, E-business Suite19116nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Mediawiki144178new
- 3MicrosoftWindows Server Version 2004, Windows Server Version 20h2, Windows 10 Version 200414052new
- 4ApplemacOS, Mac OS X, iPhone OS13065new
- 5FedoraprojectFedora12487new
- 6DebianDebian Linux116173new
- 7Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition111155new
- 8Ао "нппкт"Осон Основа Оnyx9154new
- 9Ао «ивк»Альт 8 Сп, Альт Сп 10861nonenew
- 10GoogleGoogle Chrome, Chrome, Android7863new
- 11Ао «концерн Вниинс»Ос Он «стрелец»7882new
- 12UnknownTutor Lms – Elearning and Online Course Solution, Elementor Website Builder, Patreon WordPress669nonenew
- 13NetappActive Iq Unified Manager, Snapcenter, Oncommand Workflow Automation550nonenew
- 14JuniperJunos, Junos OS Evolved, Paragon Active Assurance Control Center532nonenew
- 15Juniper NetworksJunos OS, Junos OS Evolved, Junos532nonenew
- 16MavenCom.vaadin:vaadin-bom, Com.vaadin:flow-server, Org.jenkins-ci.plugins:hp-application-automation-tools-plugin536nonenew
- 17CiscoFirepower Threat Defense, Cisco Small Business RV Series Router Firmware, Cisco RV345P461nonenew
- 18npmPostcss, @azure/ms-rest-nodeauth, Backbone-query-parameters468nonenew
- 19Red HatRed Hat Enterprise Linux, Enterprise Linux, Ansible Tower4062new
- 20AsusZ10PR-D16 Firmware, Bmc Firmware For Z10PR-D16, Bmc Firmware For ASMB8-IKVM380nonenew
- 21Fedora ProjectFedora3023new
- 22CanonicalUbuntu, Ubuntu Linux, Unity-firefox-extension2852new
- 23IBMCollaborative Lifecycle Management, Doors Next, Engineering Insights270nonenew
- 24PyPIMatrix-sydent, Matrix-synapse, Vyper271nonenew
- 25SiemensNucleus Source Code, Nucleus Net, Nucleus Readystart V3274nonenew
Severity
How this month's CVEs score on CVSS; 133 have no score yet. Severity is not exploitation.
- Critical228
- High792
- Medium770
- Low47
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS198
- CWE-787Out-of-bounds Write119
- CWE-125Out-of-bounds Read69
- CWE-120Buffer Overflow62
- CWE-89SQL Injection61
- CWE-78OS Command Injection59
- CWE-20Improper Input Validation56
- CWE-22Path Traversal45
- CWE-200Information Exposure40
- CWE-352CSRF40
- CWE-416Use After Free36
- CWE-287Improper Authentication31
- CWE-269Improper Privilege Mgmt30
- CWE-476NULL Pointer Dereference30
- CWE-863Incorrect Authorization27
- CWE-119Memory Buffer Bounds25
- CWE-190Integer Overflow25
- CWE-400Resource Consumption23
- CWE-284Improper Access Control19
- CWE-918SSRF19
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems42818% of sector-tagged CVEs
- OSS Libraries34414% of sector-tagged CVEs
- Enterprise Software26911% of sector-tagged CVEs
- Mobile Apps2289% of sector-tagged CVEs
- Databases2079% of sector-tagged CVEs
- Networking Infrastructure2068% of sector-tagged CVEs
- Web & CMS Plugins1918% of sector-tagged CVEs
- Hardware Firmware964% of sector-tagged CVEs
- 7 smaller sectors366
- Not yet classified95
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 120Buffer Overflow | 89SQL Injection | 78OS Command Injection | 20Improper Input Validation | 22Path Traversal | 200Information Exposure | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 3 | ||||||
| Oracle Corp. | 1 | 2 | ||||||||
| Oracle Corporation | 1 | |||||||||
| Сообщество Свободного Программного Обеспечения | 4 | 18 | 11 | 3 | 1 | 7 | 2 | 3 | ||
| Microsoft Corp | 1 | 6 | 1 | 4 | ||||||
| Apple | 2 | 33 | 28 | 2 | 2 | |||||
| Fedoraproject | 2 | 12 | 7 | 2 | 1 | 5 | 1 | 3 | ||
| Debian | 5 | 13 | 6 | 2 | 6 | 2 | 3 | |||
| Ооо «русбитех-астра» | 2 | 15 | 8 | 2 | 5 | 2 | 2 | |||
| Microsoft | 1 | 2 | 1 | |||||||
| Ао «нппкт» | 2 | 11 | 7 | 1 | 5 | 2 | 4 | |||
| Ао «ивк» | 4 | 6 | 1 | 5 | 1 |
CVEs published in April 2021
22 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2021-22205An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote c...KEV10.0
- CVE-2021-22893Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connec...KEV10.0
- CVE-2020-2509Command Injection Vulnerability in QTS and QuTS heroKEV9.8
- CVE-2021-1870A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A re...KEV9.8
- CVE-2021-1871A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A re...KEV9.8
- CVE-2021-20021A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.KEV9.8
- CVE-2021-20090A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypa...KEV9.8
- CVE-2021-1789A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS ...KEV8.8
- CVE-2021-21206Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-21220Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.KEV8.8
- CVE-2021-3493The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combina...KEV8.8
- CVE-2021-28310Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-20022SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.KEV7.2
- CVE-2021-1782A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4...KEV7.0
- CVE-2021-22204Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious imageKEV6.8
- CVE-2021-1879This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may l...KEV6.1
- CVE-2021-20023SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.KEV4.9
- CVE-2021-29357The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.8.6
- CVE-2021-29441Authentication bypass8.6
- CVE-2021-28924Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.6.1
- CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO4.8