August 2021
2,317 CVEs published, +40% on July 2021 and +79% on August 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 25312% of the 2,114 with a CVSS score
- Added to CISA KEV
- 022 of this month's CVEs are in KEV, listed a median 229.5 days after publication
- Vendors
- 8883,473 products
- Top weakness
- XSSCWE-79 · 322 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Gpac, Linux227103new
- 2ApplemacOS, iPhone OS, iPadOS15438new
- 3GoogleTensorflow, Chrome, Google Chrome13721new
- 4FedoraprojectFedora, Extra Packages For Enterprise Linux12353new
- 5DebianDebian Linux12233new
- 6Ао "нппкт"Осон Основа Оnyx11741new
- 7Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition11332new
- 8UnknownWorkreap, Photo Gallery By 10web – Mobile-friendly Image Gallery, User Registration & User Profile – Profile Builder944nonenew
- 9Crates.ioCgc, Libpulse-binding, Ckb9013nonenew
- 10PyPITensorflow-gpu, Tensorflow, Tensorflow-cpu8611nonenew
- 11AdobeAcrobat Reader, Acrobat Dc, Acrobat Reader Dc790nonenew
- 12MicrosoftWindows Server 2019, Windows Server 2016, Windows 10 Version 20h26345new
- 13TensorflowTensorflow581nonenew
- 14PackagistShopware/platform, Shopware/core, Mautic/core5531new
- 15Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт 8 Сп Рабочая Станция5521new
- 16MavenCom.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Com.thoughtworks.xstream:xstream5121new
- 17OracleCommunications Cloud Native Core Policy, Commerce Guided Search, Communications Cloud Native Core Binding Support Function4821new
- 18Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Software Collections4622new
- 19Ао «концерн Вниинс»Ос Он «стрелец»463nonenew
- 20HuaweiMagic Ui, Emui, Harmonyos447nonenew
- 21npmTar, Node-tar, Ckeditor4424nonenew
- 22FoxitsoftwarePdf Reader, Pdf Editor, Foxit Reader409nonenew
- 23GpacGpac360nonenew
- 24NetappSnapmanager, Solidfire, Hci Management Node3521new
- 25SiemensSinec Infrastructure Network Services, Simatic RTU3031C Firmware, Sinec Ins352nonenew
Severity
How this month's CVEs score on CVSS; 203 have no score yet. Severity is not exploitation.
- Critical253
- High932
- Medium858
- Low71
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS322
- CWE-787Out-of-bounds Write140
- CWE-125Out-of-bounds Read90
- CWE-416Use After Free88
- CWE-89SQL Injection83
- CWE-352CSRF69
- CWE-20Improper Input Validation63
- CWE-362Race Condition53
- CWE-476NULL Pointer Dereference49
- CWE-22Path Traversal45
- CWE-120Buffer Overflow44
- CWE-77Command Injection43
- CWE-434Unrestricted File Upload41
- CWE-78OS Command Injection39
- CWE-863Incorrect Authorization37
- CWE-502Deserialization36
- CWE-119Memory Buffer Bounds30
- CWE-68030
- CWE-287Improper Authentication29
- CWE-269Improper Privilege Mgmt27
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries56219% of sector-tagged CVEs
- Operating Systems42814% of sector-tagged CVEs
- Mobile Apps34211% of sector-tagged CVEs
- Enterprise Software33011% of sector-tagged CVEs
- Web & CMS Plugins31010% of sector-tagged CVEs
- Consumer Software1766% of sector-tagged CVEs
- Networking Infrastructure1545% of sector-tagged CVEs
- ICS / OT / IoT1234% of sector-tagged CVEs
- 7 smaller sectors493
- Not yet classified117
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 416Use After Free | 89SQL Injection | 352CSRF | 20Improper Input Validation | 362Race Condition | 476NULL Pointer Dereference | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 11 | 18 | 11 | 13 | 2 | 5 | 5 | 10 | 6 | |
| Apple | 1 | 19 | 15 | 7 | 3 | 11 | ||||
| 19 | 22 | 23 | 12 | 1 | 11 | |||||
| Fedoraproject | 4 | 11 | 5 | 20 | 3 | 6 | 4 | 1 | ||
| Debian | 5 | 6 | 5 | 8 | 4 | 3 | 1 | 3 | ||
| Ао «нппкт» | 1 | 10 | 6 | 9 | 4 | 5 | 1 | 5 | ||
| Ооо «русбитех-астра» | 1 | 13 | 7 | 27 | 5 | 1 | 2 | 3 | ||
| Crates.io | 2 | 1 | 3 | 33 | ||||||
| PyPI | 7 | 2 | 13 | 2 | 6 | 11 | 1 | |||
| Adobe | 2 | 20 | 24 | 11 | 3 | 3 | ||||
| Adobe Systems Inc. | 2 | 19 | 24 | 10 | 3 | 3 | ||||
| Microsoft Corp | 2 | 6 | 6 |
CVEs published in August 2021
26 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2021-20028Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware a...KEV9.8
- CVE-2021-26084In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Da...KEV9.8
- CVE-2021-35394Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vul...KEV9.8
- CVE-2021-35395Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface ...KEV9.8
- CVE-2021-36380Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.KEV9.8
- CVE-2021-30563Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-30858A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arb...KEV8.8
- CVE-2021-39144XStream is vulnerable to a Remote Command Execution attackKEV8.5
- CVE-2021-32648Account Takeover in OctobercmsKEV8.2
- CVE-2021-30860An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a...KEV7.8
- CVE-2021-30869A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat...KEV7.8
- CVE-2021-30883A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8...KEV7.8
- CVE-2021-30900An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execu...KEV7.8
- CVE-2021-30952An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously c...KEV7.8
- CVE-2021-30983A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.KEV7.8
- CVE-2021-34484Windows User Profile Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-34486Windows Event Tracing Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-36948Windows Update Medic Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-31010A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2....KEV7.5
- CVE-2021-36942Windows LSA Spoofing VulnerabilityKEV7.5
- CVE-2021-26085Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected vers...KEV5.3
- CVE-2021-26086Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions...KEV5.3
- CVE-2021-37538Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year pa...9.8
- CVE-2021-37381Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed thr...8.8
- CVE-2021-28635Adobe Acrobat Reader Use-After-Free Vulnerability7.8
- CVE-2021-22926libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is b...7.5