CVE Tools
Sign in
month report

October 2021

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

October 2021 closed with 1,759 published CVEs. 195 criticals, oracle led volume, mostly via mysql server. Top weakness class — CWE-79 (293 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,759
— MoM— YoY
Severity mix
195 / 662
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
10.8%
190 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1604.1
n=190
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
28
n=18
Detection gap

KEV pressure, no Nuclei coverage

October 2021 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in October 2021

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write89SQL Injection22Path Traversal125Out-of-bounds Read20Improper Input Validation434Unrestricted File Upload416Use After Free78OS Command Injection352CSRForacle35212oracle corporation21google1411204191netapp372222fedoraproject41532112microsoft corp2311ао «нппкт»1934214сообщество свободного программного обеспечения11254110debian28221101microsoft21huawei23643ооо «русбитех-астра»1413211

Most discussed CVEs — October 2021

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1oracle—
    161 CVE5 critCVSS 6.2
    NEWKEV 2Nuclei 9PoC 7
    mysql server (44) · mysql (42) · openjdk (13)
  • 2google—
    111 CVE2 critCVSS 6.6
    NEWKEV 5PoC 6
    android (81) · google chrome (28) · chrome (28)
  • 3netapp—
    102 CVE3 critCVSS 5.8
    NEWKEV 2Nuclei 5PoC 7
    oncommand insight (70) · snapcenter (54) · active iq unified manager (14)
  • 4fedoraproject—
    100 CVE7 critCVSS 6.7
    NEWKEV 8Nuclei 5PoC 12
    fedora (100)
  • 5microsoft—
    94 CVE3 critCVSS 7.1
    NEWKEV 6PoC 4
    windows server 2004 (server core installation) (44) · windows server 2022 (44) · windows server version 2004 (44)
  • 6ао "нппкт"—
    82 CVE5 critCVSS 6.8
    NEWKEV 7Nuclei 5PoC 11
    осон основа оnyx (82)
  • 7сообщество свободного программного обеспечения—
    79 CVE5 critCVSS 6.8
    NEWKEV 2Nuclei 3PoC 10
    debian gnu/linux (66) · linux (9) · webkitgtk (4)
  • 8debian—
    75 CVE2 critCVSS 6.8
    NEWKEV 3Nuclei 2PoC 8
    debian linux (75)
  • 9unknown—
    68 CVE1 critCVSS 5.8
    NEWNuclei 68PoC 32
    formidable form builder – contact form, survey & quiz forms plugin for wordpress (2) · weather effect – christmas santa snow falling (2) · appointment hour booking – wordpress booking plugin (2)
  • 10huawei—
    67 CVE8 critCVSS 6.9
    NEW
    emui (38) · magic ui (38) · harmonyos (22)
  • 11ооо «русбитех-астра»—
    61 CVE4 critCVSS 7.0
    NEWKEV 5Nuclei 1PoC 7
    astra linux special edition (57) · astra linux special edition для «эльбрус» (13) · astra linux common edition (3)
  • 12ао «концерн вниинс»—
    55 CVE4 critCVSS 6.9
    NEWKEV 7Nuclei 4PoC 7
    ос он «стрелец» (55)
  • 13cisco—
    52 CVECVSS 5.9
    NEWPoC 52
    firepower threat defense (20) · cisco adaptive security appliance (asa) software (11) · asa 5505 firmware (10)
  • 14apple—
    47 CVE1 critCVSS 7.1
    NEWKEV 1
    macos (39) · ipados (29) · iphone os (29)
  • 15ibm—
    44 CVE4 critCVSS 6.7
    NEW
    sterling b2b integrator (17) · sterling file gateway (10) · rational collaborative lifecycle management (5)
  • 16juniper—
    42 CVE1 critCVSS 7.0
    NEWNuclei 2PoC 41
    junos (32) · junos os evolved (14) · session and resource control (3)
  • 17juniper networks—
    42 CVE1 critCVSS 7.2
    NEWNuclei 2PoC 41
    junos os (32) · junos os evolved (14) · junos (12)
  • 18fedora project—
    39 CVE4 critCVSS 6.8
    NEWKEV 4Nuclei 3PoC 5
    fedora (39)
  • 19gitlab—
    36 CVECVSS 5.1
    NEWPoC 2
    gitlab (36)
  • 20ао «ивк»—
    34 CVE3 critCVSS 6.3
    NEWKEV 3Nuclei 5PoC 4
    альт 8 сп (34) · альт сп 10 (1)
  • 21samsung mobile—
    33 CVECVSS 5.4
    NEWKEV 2
    samsung mobile devices (25) · samsung notes (7) · galaxy store (1)
  • 22packagist—
    32 CVE4 critCVSS 6.8
    NEWNuclei 4PoC 11
    grumpydictator/firefly-iii (4) · snipe/snipe-it (3) · typo3/cms-core (2)
  • 23qualcomm—
    31 CVECVSS 7.9
    NEWPoC 2
    wcd9380 firmware (29) · wcd9370 firmware (28) · wcd9375 firmware (28)
  • 24qualcomm, inc.—
    31 CVECVSS 7.9
    NEWPoC 2
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon wearables (8) · snapdragon auto, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile (2) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2)
  • 25siemens—
    31 CVE5 critCVSS 7.5
    NEWPoC 2
    sinec nms (15) · scalance w1750d firmware (6) · sinec infrastructure network services (3)
  • 26novell inc.—
    30 CVE2 critCVSS 6.6
    NEWKEV 2Nuclei 2PoC 4
    opensuse leap (25) · suse linux enterprise server (9) · suse linux enterprise desktop (8)
  • 27pypi—
    29 CVE8 critCVSS 7.7
    NEWNuclei 2PoC 6
    cobbler (3) · onionshare-cli (2) · apache-superset (2)
  • 28ооо «ред софт»—
    28 CVECVSS 6.4
    NEWNuclei 1PoC 4
    ред ос (28)
  • 29maven—
    27 CVE5 critCVSS 7.0
    NEWNuclei 1PoC 4
    org.webjars.npm:jquery-ui (3) · edu.stanford.nlp:stanford-corenlp (2) · org.apache.storm:storm (2)
  • 30arubanetworks—
    24 CVE4 critCVSS 7.6
    NEW
    clearpass policy manager (18) · aruba instant (6)
  • 31npm—
    24 CVE8 critCVSS 8.0
    NEWNuclei 2PoC 6
    aaptjs (6) · jquery-ui (3) · kindeditor (2)
  • 32redhat—
    23 CVECVSS 6.7
    NEWNuclei 1
    red hat enterprise linux (19) · red hat build of openjdk (7) · red hat software collections (4)
  • 33zohocorp—
    20 CVE15 critCVSS 9.1
    NEWNuclei 14PoC 1
    manageengine admanager plus (16) · manageengine opmanager (2) · manageengine applications manager (1)
  • 34apache software foundation—
    17 CVE4 critCVSS 7.8
    NEWKEV 2Nuclei 4PoC 3
    apache openoffice (5) · apache http server (3) · openoffice (3)
  • 35auvesy—
    17 CVE6 critCVSS 8.1
    NEW
    versiondog (17)
  • 36canonical—
    17 CVECVSS 6.7
    NEW
    ubuntu (15) · apport (2) · multipass (2)
  • 37apache—
    15 CVE4 critCVSS 7.6
    NEWKEV 2Nuclei 4PoC 3
    openoffice (5) · http server (3) · storm (2)
  • 38corel—
    15 CVECVSS 6.7
    NEW
    presentations 2020 (5) · pdf fusion (3) · photopaint 2020 (3)
  • 39corel corp.—
    15 CVECVSS 6.7
    NEW
    corel presentations (5) · pdf fusion (3) · coreldraw (2)
  • 40go—
    15 CVE2 critCVSS 6.4
    NEWKEV 1Nuclei 1PoC 2
    github.com/docker/docker (2) · github.com/foxcpp/maddy (2) · github.com/hashicorp/vault (2)
  • 41adobe—
    14 CVE2 critCVSS 6.3
    NEW
    acrobat reader (7) · acrobat reader dc (6) · acrobat dc (6)
  • 42fortinet inc.—
    14 CVECVSS 6.8
    NEW
    fortigate ips (13) · forticlientems (1)
  • 43mediawiki—
    14 CVECVSS 6.1
    NEWPoC 1
    mediawiki (14)
  • 44ао «нтц ит роса»—
    14 CVECVSS 6.2
    NEWNuclei 1PoC 1
    rosa virtualization (5) · роса кобальт (5) · роса хром (3)
  • 45cybozu—
    13 CVECVSS 6.0
    NEW
    remote service manager (13)
  • 46cybozu, inc.—
    13 CVECVSS 6.0
    NEW
    cybozu remote service (13)
  • 47inhand networks—
    13 CVE5 critCVSS 8.1
    NEW
    ir615 router (13)
  • 48inhandnetworks—
    13 CVE5 critCVSS 8.1
    NEW
    ir615 firmware (13)
  • 49rubygems—
    12 CVECVSS 6.0
    NEWNuclei 1PoC 10
    camaleon_cms (4) · jquery-ui-rails (3) · actionpack (2)
  • 50trendmicro—
    12 CVECVSS 7.6
    NEW
    apex one (12) · trend micro apex one (12) · trend micro worry-free business security (8)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79293—
2CWE-78793—
3CWE-8972—
4CWE-2267—
5CWE-12561—
6CWE-2047—
7CWE-43446—
8CWE-41638—
9CWE-7837—
10CWE-35236—
11CWE-26935—
12CWE-12033—
13CWE-20031—
14CWE-40025—
15CWE-86224—
16CWE-28721—
17CWE-19020—
18CWE-7720—
19CWE-28518—
20CWE-77018—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Enterprise Software369 CVE
    74 crit4 KEV83 vendorsCVSS 8.8
    oncommand insight (70) · snapcenter (54) · sterling b2b integrator (17)
  • Operating Systems335 CVE
    49 crit166 KEV32 vendorsCVSS 7.1
    fedora (139) · осон основа оnyx (82) · debian linux (75)
  • Web & CMS Plugins242 CVE
    33 crit6 KEV143 vendorsCVSS 8.1
    dedecms (15) · mediawiki (14) · openoffice (8)
  • OSS Libraries241 CVE
    58 crit1 KEV72 vendorsCVSS 8.1
    php (8) · gpac (6) · libjpeg-turbo (6)
  • Mobile Apps236 CVE
    22 crit20 KEV7 vendorsCVSS 7.1
    android (85) · emui (38) · magic ui (38)
  • Networking Infrastructure194 CVE
    28 crit2 KEV37 vendorsCVSS 7.6
    junos (44) · firepower threat defense (37) · junos os (32)
  • Databases175 CVE
    18 crit8 KEV11 vendorsCVSS 7.4
    mysql server (49) · mysql (42) · openjdk (24)
  • DevTools & CI85 CVE
    11 crit19 vendorsCVSS 8.2
    gitlab (36) · backstage (1)
  • ICS / OT / IoT81 CVE
    132 crit32 vendorsCVSS 8.9
    750-8202 firmware (7) · 750-8203 firmware (7) · 750-8204 firmware (7)
  • Hardware Firmware71 CVE
    9 crit2 KEV17 vendorsCVSS 8.6
    wcd9380 firmware (29) · wcd9370 firmware (28) · wcd9375 firmware (28)
  • Consumer Software57 CVE
    6 crit23 vendorsCVSS 7.5
    acrobat reader (7) · acrobat dc (6) · acrobat reader dc (6)
  • Cloud & SaaS55 CVE
    2 crit29 vendorsCVSS 8.3
    security-advisories (8) · emias os (6) · panel (2)
  • Security Products50 CVE
    3 crit23 vendorsCVSS 9.8
    apex one (12) · trend micro apex one (12) · trend micro worry-free business security (8)
  • Communications27 CVE
    6 crit1 KEV20 vendorsCVSS 8.5
    freeswitch (11) · ht801 firmware (2) · call recording (1)
  • AI / ML8 CVE
    3 crit5 vendorsCVSS 9.1
    rasa (2) · stanfordnlp/corenlp (2) · backstage (1)
  • Unclassified112 CVE
    19 crit2 KEV94 vendorsCVSS 7.1
    zoom latitude (5) · zoom latitude pogrammer\/recorder\/monitor 3120 firmware (5) · dap-2020 (4)
Weakness × Sector

Which weaknesses hit which solution categories in October 2021

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write89SQL Injection22Path Traversal125Out-of-bounds Read20Improper Input Validation434Unrestricted File Upload416Use After Free78OS Command Injection352CSRFOperating Systems4401103711261Enterprise Software71123122247Web & CMS Plugins152227212217OSS Libraries35152115941910Networking Infrastructure19741221433165Hardware Firmware91648742Consumer Software9242313111912Databases45121ICS / OT / IoT3108132337DevTools & CI827311211