October 2021
1,759 CVEs published, −9% on September 2021 and +9% on October 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 19511% of the 1,737 with a CVSS score
- Added to CISA KEV
- 018 of this month's CVEs are in KEV, listed a median 28 days after publication
- Vendors
- 7042,557 products
- Top weakness
- XSSCWE-79 · 293 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, Openjdk16152new
- 2GoogleAndroid, Google Chrome, Chrome11125new
- 3NetappOncommand Insight, Snapcenter, Active Iq Unified Manager10232new
- 4FedoraprojectFedora10078new
- 5MicrosoftWindows Server 2004 (Server Core Installation), Windows Server 2022, Windows Server Version 20049436new
- 6Ао "нппкт"Осон Основа Оnyx8257new
- 7Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Webkitgtk7952new
- 8DebianDebian Linux7523new
- 9UnknownFormidable Form Builder – Contact Form, Survey & Quiz Forms Plugin For WordPress, Weather Effect – Christmas Santa Snow Falling, Appointment Hour Booking – WordPress Booking Plugin681nonenew
- 10HuaweiEmui, Magic Ui, Harmonyos678nonenew
- 11Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition6145new
- 12Ао «концерн Вниинс»Ос Он «стрелец»5547new
- 13CiscoFirepower Threat Defense, Cisco Adaptive Security Appliance (ASA) Software, ASA 5505 Firmware520nonenew
- 14ApplemacOS, iPadOS, iPhone OS4711new
- 15IBMSterling B2B Integrator, Sterling File Gateway, Rational Collaborative Lifecycle Management444nonenew
- 16JuniperJunos, Junos OS Evolved, Session and Resource Control421nonenew
- 17Juniper NetworksJunos OS, Junos OS Evolved, Junos421nonenew
- 18Fedora ProjectFedora3944new
- 19GitLabGitLab360nonenew
- 20Ао «ивк»Альт 8 Сп, Альт Сп 103433new
- 21Samsung MobileSamsung Mobile Devices, Samsung Notes, Galaxy Store3302new
- 22PackagistGrumpydictator/firefly-iii, Snipe/snipe-it, Typo3/cms-core324nonenew
- 23QualcommWCD9380 Firmware, WCD9370 Firmware, WCD9375 Firmware310nonenew
- 24Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Wearables, Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables310nonenew
- 25SiemensSinec Nms, Scalance W1750D Firmware, Sinec Infrastructure Network Services315nonenew
Severity
How this month's CVEs score on CVSS; 22 have no score yet. Severity is not exploitation.
- Critical195
- High662
- Medium830
- Low50
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS293
- CWE-787Out-of-bounds Write93
- CWE-89SQL Injection72
- CWE-22Path Traversal67
- CWE-125Out-of-bounds Read61
- CWE-20Improper Input Validation47
- CWE-434Unrestricted File Upload46
- CWE-416Use After Free38
- CWE-78OS Command Injection37
- CWE-352CSRF36
- CWE-269Improper Privilege Mgmt35
- CWE-120Buffer Overflow33
- CWE-200Information Exposure31
- CWE-400Resource Consumption25
- CWE-862Missing Authorization24
- CWE-287Improper Authentication21
- CWE-190Integer Overflow20
- CWE-77Command Injection20
- CWE-28518
- CWE-770Allocation Without Limits18
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software36916% of sector-tagged CVEs
- Operating Systems33514% of sector-tagged CVEs
- Web & CMS Plugins24210% of sector-tagged CVEs
- OSS Libraries24110% of sector-tagged CVEs
- Mobile Apps23610% of sector-tagged CVEs
- Networking Infrastructure1948% of sector-tagged CVEs
- Databases1757% of sector-tagged CVEs
- 8 smaller sectors434
- Not yet classified112
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 22Path Traversal | 125Out-of-bounds Read | 20Improper Input Validation | 434Unrestricted File Upload | 416Use After Free | 78OS Command Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 3 | 5 | 2 | 1 | 2 | |||||
| Oracle Corporation | 2 | 1 | ||||||||
| 14 | 1 | 1 | 20 | 4 | 19 | 1 | ||||
| Netapp | 3 | 7 | 2 | 2 | 2 | 2 | ||||
| Fedoraproject | 4 | 15 | 3 | 2 | 1 | 12 | ||||
| Microsoft Corp | 2 | 3 | 11 | |||||||
| Ао «нппкт» | 1 | 9 | 3 | 4 | 2 | 14 | ||||
| Сообщество Свободного Программного Обеспечения | 1 | 12 | 5 | 4 | 1 | 10 | ||||
| Debian | 2 | 8 | 2 | 2 | 1 | 10 | 1 | |||
| Microsoft | 2 | 1 | ||||||||
| Huawei | 2 | 3 | 6 | 4 | 3 | |||||
| Ооо «русбитех-астра» | 14 | 1 | 3 | 2 | 11 |
CVEs published in October 2021
20 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2021-27561Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.KEV9.8
- CVE-2021-39226Snapshot authentication bypass in grafanaKEV9.8
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49KEV9.8
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)KEV9.8
- CVE-2021-42258BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL i...KEV9.8
- CVE-2021-30633Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...KEV9.6
- CVE-2021-37973Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.KEV9.6
- CVE-2021-30632Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-37975Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-30807A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execut...KEV7.8
- CVE-2021-40449Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-40450Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-41357Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-20123A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this ...KEV7.5
- CVE-2021-20124A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerabi...KEV7.5
- CVE-2021-25487Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invali...KEV7.3
- CVE-2021-37976Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.KEV6.5
- CVE-2021-25489Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.KEV3.3
- CVE-2021-41648An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.7.5
- CVE-2021-35621Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 an...6.3