CVE Tools
Sign in
month report

April 2021

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

April 2021 closed with 1,970 published CVEs. 228 criticals, oracle led volume, mostly via mysql. Top weakness class — CWE-79 (198 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,970
— MoM— YoY
Severity mix
228 / 792
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
8.2%
161 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1789.3
n=161
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
208
n=18
Detection gap

KEV pressure, no Nuclei coverage

April 2021 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in April 2021

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write125Out-of-bounds Read120Buffer Overflow89SQL Injection78OS Command Injection20Improper Input Validation22Path Traversal200Information Exposure352CSRForacle1113oracle corp.12oracle corporation1сообщество свободного программного обеспечения4181131723microsoft corp1614apple2332822fedoraproject212721513debian51362623ооо «русбитех-астра»21582522microsoft121ао «нппкт»21171524ао «ивк»46151

Most discussed CVEs — April 2021

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1oracle—
    191 CVE16 critCVSS 6.4
    Nuclei 12PoC 7
    mysql (39) · mysql server (39) · e-business suite (28)
  • 2сообщество свободного программного обеспечения—
    144 CVE17 critCVSS 7.1
    KEV 8Nuclei 3PoC 23
    debian gnu/linux (133) · linux (14) · mediawiki (6)
  • 3microsoft—
    140 CVE5 critCVSS 7.6
    KEV 2Nuclei 3PoC 8
    windows server version 2004 (79) · windows server version 20h2 (79) · windows 10 version 2004 (79)
  • 4apple—
    130 CVE6 critCVSS 7.4
    KEV 5PoC 1
    macos (119) · mac os x (102) · iphone os (89)
  • 5fedoraproject—
    124 CVE8 critCVSS 6.7
    KEV 7Nuclei 1PoC 18
    fedora (124)
  • 6debian—
    116 CVE17 critCVSS 7.2
    KEV 3Nuclei 4PoC 17
    debian linux (116)
  • 7ооо «русбитех-астра»—
    111 CVE15 critCVSS 7.1
    KEV 5Nuclei 1PoC 20
    astra linux special edition (108) · astra linux special edition для «эльбрус» (32) · astra linux common edition (4)
  • 8ао "нппкт"—
    91 CVE5 critCVSS 6.9
    KEV 4Nuclei 3PoC 18
    осон основа оnyx (91)
  • 9ао «ивк»—
    86 CVE1 critCVSS 6.0
    PoC 6
    альт 8 сп (86) · альт сп 10 (1)
  • 10google—
    78 CVE6 critCVSS 7.5
    KEV 3Nuclei 1PoC 6
    google chrome (39) · chrome (39) · android (35)
  • 11ао «концерн вниинс»—
    78 CVE8 critCVSS 7.1
    KEV 2Nuclei 1PoC 10
    ос он «стрелец» (78)
  • 12unknown—
    66 CVE9 critCVSS 6.8
    NEWNuclei 66PoC 27
    tutor lms – elearning and online course solution (6) · elementor website builder (6) · patreon wordpress (5)
  • 13netapp—
    55 CVECVSS 5.6
    Nuclei 2PoC 6
    active iq unified manager (46) · snapcenter (42) · oncommand workflow automation (39)
  • 14juniper—
    53 CVE2 critCVSS 7.0
    PoC 52
    junos (48) · junos os evolved (8) · paragon active assurance control center (1)
  • 15juniper networks—
    53 CVE2 critCVSS 6.9
    PoC 52
    junos os (48) · junos os evolved (8) · junos (7)
  • 16maven—
    53 CVE6 critCVSS 6.2
    Nuclei 7PoC 4
    com.vaadin:vaadin-bom (12) · com.vaadin:flow-server (7) · org.jenkins-ci.plugins:hp-application-automation-tools-plugin (4)
  • 17cisco—
    46 CVE1 critCVSS 6.8
    Nuclei 2PoC 42
    firepower threat defense (10) · cisco small business rv series router firmware (9) · cisco rv345p (8)
  • 18npm—
    46 CVE8 critCVSS 7.2
    Nuclei 4PoC 14
    postcss (2) · @azure/ms-rest-nodeauth (1) · backbone-query-parameters (1)
  • 19redhat—
    40 CVE6 critCVSS 6.8
    KEV 2PoC 6
    red hat enterprise linux (27) · enterprise linux (10) · ansible tower (2)
  • 20asus—
    38 CVECVSS 5.0
    NEW
    z10pr-d16 firmware (18) · bmc firmware for z10pr-d16 (18) · bmc firmware for asmb8-ikvm (18)
  • 21fedora project—
    30 CVE2 critCVSS 6.0
    KEV 3PoC 6
    fedora (30)
  • 22canonical—
    28 CVE5 critCVSS 6.8
    KEV 2PoC 6
    ubuntu (25) · ubuntu linux (5) · unity-firefox-extension (2)
  • 23ibm—
    27 CVECVSS 5.9
    collaborative lifecycle management (4) · doors next (4) · engineering insights (4)
  • 24pypi—
    27 CVE1 critCVSS 6.5
    PoC 1
    matrix-sydent (4) · matrix-synapse (3) · vyper (2)
  • 25siemens—
    27 CVE4 critCVSS 8.6
    PoC 3
    nucleus source code (9) · nucleus net (9) · nucleus readystart v3 (7)
  • 26gpac—
    25 CVE1 critCVSS 6.4
    NEWPoC 10
    gpac (25)
  • 27packagist—
    25 CVE5 critCVSS 7.1
    Nuclei 1PoC 11
    tribalsystems/zenario (3) · openmage/magento-lts (2) · shopware/core (2)
  • 28ооо «ред софт»—
    22 CVE1 critCVSS 6.3
    PoC 7
    ред ос (22)
  • 29arubanetworks—
    21 CVE1 critCVSS 7.4
    airwave (11) · clearpass (9) · clearpass policy manager (1)
  • 30dell—
    21 CVE1 critCVSS 6.8
    integrated dell remote access controller (idrac) (6) · idrac9 firmware (6) · dell hybrid client (dhc) (4)
  • 31samsung mobile—
    20 CVE1 critCVSS 5.7
    NEWPoC 1
    samsung mobile devices (11) · samsung email (2) · gallery (1)
  • 32crates.io—
    19 CVE7 critCVSS 8.3
    PoC 4
    id-map (3) · arenavec (2) · reorder (2)
  • 33novell inc.—
    19 CVECVSS 7.6
    KEV 1PoC 5
    opensuse leap (16) · suse linux enterprise server (9) · suse linux enterprise server for sap applications (7)
  • 34parallels—
    19 CVECVSS 7.0
    NEW
    desktop (19) · parallels desktop (19)
  • 35mediawiki—
    18 CVECVSS 5.3
    NEWPoC 2
    mediawiki (18)
  • 36adobe—
    16 CVECVSS 7.0
    Nuclei 1
    bridge (6) · adobe bridge (6) · genuine service (3)
  • 37apache—
    15 CVE6 critCVSS 7.5
    Nuclei 4PoC 2
    solr (4) · tapestry (2) · ofbiz (2)
  • 38go—
    15 CVECVSS 6.3
    Nuclei 1
    github.com/pomerium/pomerium (2) · github.com/cortexproject/cortex (1) · github.com/filecoin-project/lotus (1)
  • 39qualcomm—
    15 CVE1 critCVSS 8.0
    wcn3998 firmware (14) · wsa8815 firmware (14) · wcd9341 firmware (14)
  • 40qualcomm, inc.—
    15 CVE1 critCVSS 8.1
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon mobile (3) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon wearables (1)
  • 41nvidia—
    14 CVECVSS 7.0
    nvidia virtual gpu software (8) · virtual gpu manager (8) · gpu display driver (5)
  • 42sap—
    14 CVE1 critCVSS 6.3
    netweaver application server java (4) · netweaver process integration (2) · focused run (1)
  • 43sap se—
    14 CVE1 critCVSS 6.3
    sap commerce (1) · sap fiori apps 2.0 for travel management in sap erp (1) · sap focused run (1)
  • 44apache software foundation—
    13 CVE6 critCVSS 8.1
    Nuclei 4PoC 1
    apache solr (3) · maven (2) · ofbiz (2)
  • 45dlink—
    13 CVE6 critCVSS 9.0
    Nuclei 1PoC 3
    dap-1880ac firmware (4) · dap-1880ac (4) · dap-2020 firmware (3)
  • 46vaadin—
    13 CVECVSS 5.5
    NEWPoC 1
    vaadin (12) · flow (9) · flow-server (7)
  • 47gitlab—
    12 CVE2 critCVSS 6.2
    KEV 1Nuclei 1PoC 2
    gitlab (11) · gitlab-vscode-extension (1)
  • 48linux—
    12 CVECVSS 6.3
    PoC 1
    linux kernel (12) · linux (1)
  • 49nlnetlabs—
    12 CVE7 critCVSS 8.7
    NEW
    unbound (12)
  • 50rust-lang—
    12 CVE3 critCVSS 7.7
    NEWPoC 2
    rust (12)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79198—
2CWE-787119—
3CWE-12569—
4CWE-12062—
5CWE-8961—
6CWE-7859—
7CWE-2056—
8CWE-2245—
9CWE-20040—
10CWE-35240—
11CWE-41636—
12CWE-28731—
13CWE-26930—
14CWE-47630—
15CWE-86327—
16CWE-11925—
17CWE-19025—
18CWE-40023—
19CWE-28419—
20CWE-91819—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems428 CVE
    123 crit72 KEV43 vendorsCVSS 9.2
    fedora (154) · debian gnu/linux (133) · debian linux (116)
  • OSS Libraries344 CVE
    47 crit1 KEV101 vendorsCVSS 8.3
    gpac (25) · exiv2 (14) · rust (12)
  • Enterprise Software269 CVE
    259 crit60 vendorsCVSS 8.7
    active iq unified manager (46) · snapcenter (42) · oncommand insight (39)
  • Mobile Apps228 CVE
    41 crit55 KEV7 vendorsCVSS 7.4
    macos (125) · mac os x (102) · iphone os (89)
  • Databases207 CVE
    54 crit17 vendorsCVSS 8.3
    mysql server (78) · vm virtualbox (63) · mysql (39)
  • Networking Infrastructure206 CVE
    112 crit42 KEV42 vendorsCVSS 8.8
    junos (55) · junos os (48) · firepower threat defense (20)
  • Web & CMS Plugins191 CVE
    67 crit111 vendorsCVSS 9.6
    mediawiki (18) · wcms (6) · wordpress (5)
  • Hardware Firmware96 CVE
    130 crit6 KEV17 vendorsCVSS 9.8
    asmb8-ikvm firmware (18) · bmc firmware for asmb8-ikvm (18) · bmc firmware for z10pe-d16 ws (18)
  • Security Products84 CVE
    9 crit1 KEV43 vendorsCVSS 7.4
    apex one (8) · kaspersky anti-virus (5) · kaspersky internet security (5)
  • Consumer Software61 CVE
    4 crit3 KEV29 vendorsCVSS 8.4
    adobe bridge (6) · bridge (6) · foxit studio photo (6)
  • Cloud & SaaS61 CVE
    11 crit24 vendorsCVSS 9.1
    desktop (19) · parallels desktop (19) · carbon black cloud workload (2)
  • ICS / OT / IoT60 CVE
    104 crit28 vendorsCVSS 8.5
    an lianbao wf-1 firmware (8) · homeautomation (5) · fibaro home center (4)
  • DevTools & CI53 CVE
    6 crit2 KEV22 vendorsCVSS 8.8
    scilab (5) · gradle (3) · jetty (3)
  • Communications42 CVE
    9 crit20 vendorsCVSS 7.6
    sydent (8) · discord-recon (6) · synapse (6)
  • AI / ML5 CVE
    1 crit3 vendorsCVSS 8.6
    adtensor (1) · ceph (1) · cortex (1)
  • Unclassified95 CVE
    19 crit65 vendorsCVSS 7.5
    devolutions server (6) · dap-2020 (3) · deltaflow (3)
Weakness × Sector

Which weaknesses hit which solution categories in April 2021

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write125Out-of-bounds Read120Buffer Overflow89SQL Injection78OS Command Injection20Improper Input Validation22Path Traversal200Information Exposure352CSRFOperating Systems7614412217311OSS Libraries2321128911183115Enterprise Software41512436545Networking Infrastructure23103952211644Web & CMS Plugins751202181110Hardware Firmware69629156691Consumer Software1122862244Databases4311413ICS / OT / IoT412423125535Security Products7211244451