| CVE-2021-38648 Known exploited | High 7.8 | Open Management Infrastructure Elevation of Privilege Vulnerability Assigned by microsoft | Sep 15, 2021 |
| CVE-2021-38649 Known exploited | High 7.0 | Open Management Infrastructure Elevation of Privilege Vulnerability Assigned by microsoft | Sep 15, 2021 |
| CVE-2021-40444 Known exploited | High 8.8 | Microsoft MSHTML Remote Code Execution Vulnerability Assigned by microsoft | Sep 15, 2021 |
| CVE-2021-33044 Known exploited | Critical 9.8 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Assigned by dahua | Sep 15, 2021 |
| CVE-2021-33045 Known exploited | Critical 9.8 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Assigned by dahua | Sep 15, 2021 |
| CVE-2021-40438 Known exploited | Critical 9.0 | mod_proxy SSRF Assigned by apache | Sep 16, 2021 |
| CVE-2021-38406 Known exploited | High 7.8 | Delta Electronics DOPSoft 2 Out-of-Bounds Write Assigned by icscert | Sep 17, 2021 |
| CVE-2021-36260 Known exploited | Critical 9.8 | A command injection vulnerability in the web server of some Hikvision product. Assigned by hikvision | Sep 22, 2021 |
| CVE-2021-22005 Known exploited | Critical 9.8 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Assigned by vmware | Sep 23, 2021 |
| CVE-2021-22017 Known exploited | Medium 5.3 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. Assigned by vmware | Sep 23, 2021 |
| CVE-2021-22941 Known exploited | Critical 9.8 | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller. Assigned by hackerone | Sep 23, 2021 |
| CVE-2021-40655 Known exploited | High 7.5 | An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. Assigned by mitre | Sep 24, 2021 |
| CVE-2021-20035 Known exploited | Medium 6.5 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS. Assigned by sonicwall | Sep 27, 2021 |
| CVE-2021-41773 Known exploited | High 7.5 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 Assigned by apache | Oct 5, 2021 |
| CVE-2021-39226 Known exploited | Critical 9.8 | Snapshot authentication bypass in grafana Assigned by GitHub_M | Oct 5, 2021 |
| CVE-2021-25487 Known exploited | High 7.3 | Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid… Assigned by Samsung Mobile | Oct 6, 2021 |
| CVE-2021-25489 Known exploited | Low 3.3 | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Assigned by Samsung Mobile | Oct 6, 2021 |
| CVE-2021-42013 Known exploited | Critical 9.8 | Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) Assigned by apache | Oct 7, 2021 |
| CVE-2021-37975 Known exploited | High 8.8 | Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Oct 8, 2021 |
| CVE-2021-30632 Known exploited | High 8.8 | Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Oct 8, 2021 |
| CVE-2021-30633 Known exploited | Critical 9.6 | Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p… Assigned by Chrome | Oct 8, 2021 |
| CVE-2021-37973 Known exploited | Critical 9.6 | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | Oct 8, 2021 |
| CVE-2021-37976 Known exploited | Medium 6.5 | Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Assigned by Chrome | Oct 8, 2021 |
| CVE-2021-40449 Known exploited | High 7.8 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | Oct 13, 2021 |
| CVE-2021-40450 Known exploited | High 7.8 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | Oct 13, 2021 |
| CVE-2021-41357 Known exploited | High 7.8 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | Oct 13, 2021 |
| CVE-2021-20123 Known exploited | High 7.5 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. Assigned by tenable | Oct 13, 2021 |
| CVE-2021-20124 Known exploited | High 7.5 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. Assigned by tenable | Oct 13, 2021 |
| CVE-2021-27561 Known exploited | Critical 9.8 | Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. Assigned by mitre | Oct 15, 2021 |
| CVE-2021-30807 Known exploited | High 7.8 | A memory corruption issue was addressed with improved memory handling. Assigned by apple | Oct 19, 2021 |
| CVE-2021-42258 Known exploited | Critical 9.8 | BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. Assigned by mitre | Oct 22, 2021 |
| CVE-2021-42237 Known exploited | Critical 9.8 | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. Assigned by mitre | Nov 5, 2021 |
| CVE-2021-41379 Known exploited | Medium 5.5 | Windows Installer Elevation of Privilege Vulnerability Assigned by microsoft | Nov 10, 2021 |
| CVE-2021-42278 Known exploited | High 7.5 | Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft | Nov 10, 2021 |
| CVE-2021-42287 Known exploited | High 7.5 | Active Directory Domain Services Elevation of Privilege Vulnerability Assigned by microsoft | Nov 10, 2021 |
| CVE-2021-42292 Known exploited | High 7.8 | Microsoft Excel Security Feature Bypass Vulnerability Assigned by microsoft | Nov 10, 2021 |
| CVE-2021-42321 Known exploited | High 8.8 | Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft | Nov 10, 2021 |
| CVE-2021-41277 Known exploited | Critical 10.0 | GeoJSON URL validation can expose server files and environment variables to unauthorized users Assigned by GitHub_M | Nov 17, 2021 |
| CVE-2021-44026 Known exploited | Critical 9.8 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Assigned by mitre | Nov 19, 2021 |
| CVE-2021-38000 Known exploited | Medium 6.1 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. Assigned by Chrome | Nov 23, 2021 |
| CVE-2021-38003 Known exploited | High 8.8 | Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 23, 2021 |
| CVE-2021-44077 Known exploited | Critical 9.8 | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Assigned by mitre | Nov 29, 2021 |
| CVE-2021-23758 Known exploited | High 8.1 | Deserialization of Untrusted Data Assigned by snyk | Dec 3, 2021 |
| CVE-2021-43798 Known exploited | High 7.5 | Grafana path traversal Assigned by GitHub_M | Dec 7, 2021 |
| CVE-2021-44529 Known exploited | Critical 9.8 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). Assigned by hackerone | Dec 8, 2021 |
| CVE-2021-20038 Known exploited | Critical 9.8 | A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' use… Assigned by sonicwall | Dec 8, 2021 |
| CVE-2021-27860 Known exploited | Critical 9.8 | Arbitrary file upload vulnerability in FatPipe software Assigned by certcc | Dec 8, 2021 |
| CVE-2021-44228 Known exploited | Critical 10.0 | Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints Assigned by apache | Dec 10, 2021 |
| CVE-2021-44515 Known exploited | Critical 9.8 | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. Assigned by mitre | Dec 12, 2021 |
| CVE-2021-39935 Known exploited | Medium 6.8 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Assigned by GitLab | Dec 13, 2021 |
