Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2021

86 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-28359
    28Monitor

    Apache Airflow Reflected XSS via Origin Query Argument in URL

    MediumCVSS 6.1No exploitEPSS 14%

    apache · airflowMay 2, 2021

  • CVE-2021-21551
    85Now

    Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of servi

    HighCVSS 7.8KEVWeaponizedEPSS 79%

    dell · dbutilMay 4, 2021

  • CVE-2021-31800
    45Plan

    Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    secureauth · impacketMay 5, 2021

  • CVE-2021-24274
    29Monitor

    Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 17%

    supsystic · ultimate mapsMay 5, 2021

  • CVE-2021-24275
    29Monitor

    Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 18%

    supsystic · popupMay 5, 2021

  • CVE-2021-24276
    29Monitor

    Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 16%

    supsystic · contact formMay 5, 2021

  • CVE-2020-28017
    50Plan

    Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients

    CriticalCVSS 9.8No exploitEPSS 36%

    exim · eximMay 6, 2021

  • CVE-2020-28018
    56Plan

    Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    exim · eximMay 6, 2021

  • CVE-2020-28019
    48Plan

    Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.

    HighCVSS 7.5No exploitEPSS 61%

    exim · eximMay 6, 2021

  • CVE-2021-1497
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-1498
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-1499
    45Plan

    Cisco HyperFlex HX Data Platform File Upload Vulnerability

    MediumCVSS 5.3WeaponizedEPSS 80%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-29490
    44Plan

    Unauthenticated GET requests through Remote Image endpoints

    MediumCVSS 5.8Proof of conceptEPSS 69%

    jellyfin · jellyfinMay 6, 2021

  • CVE-2021-32030
    99Now

    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    asus · lyra mini firmwareMay 6, 2021

  • CVE-2021-28149
    31Monitor

    Hongdian H8922 3.0.5 devices allow Directory Traversal.

    MediumCVSS 6.5Proof of conceptEPSS 15%

    hongdian · h8922 firmwareMay 6, 2021

  • CVE-2021-28151
    43Plan

    Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg

    HighCVSS 8.8Proof of conceptEPSS 27%

    hongdian · h8922 firmwareMay 6, 2021

  • CVE-2021-29203
    59Plan

    A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Managemen

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    hp · edgeline infrastructure managerMay 6, 2021

  • CVE-2021-32099
    43Plan

    A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    artica · pandora fmsMay 7, 2021

  • CVE-2021-1905
    61This week

    Possible use after free due to improper handling of memory mapping of multiple processes simultaneously.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    qualcomm · apq8009 firmwareMay 7, 2021

  • CVE-2021-1906
    52Plan

    Improper handling of address deregistration on failure can lead to new GPU address allocation failure.

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    qualcomm · apq8009 firmwareMay 7, 2021

  • CVE-2021-31755
    95Now

    An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    tenda · ac11 firmwareMay 7, 2021

  • CVE-2021-28663
    69This week

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading t

    HighCVSS 8.8KEVWeaponizedEPSS 12%

    arm · bifrost gpu kernel driverMay 10, 2021

  • CVE-2021-28664
    67This week

    The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achie

    HighCVSS 8.8KEVWeaponizedEPSS 5%

    arm · bifrost gpu kernel driverMay 10, 2021

  • CVE-2020-23575
    41Plan

    A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus.

    HighCVSS 7.5Proof of conceptEPSS 36%

    kyocera · d-copia253mf plus firmwareMay 10, 2021

  • CVE-2021-21648
    27Monitor

    Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cr

    MediumCVSS 6.1No exploitEPSS 11%

    jenkins · credentialsMay 11, 2021

  • CVE-2021-21649
    43Plan

    Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site

    MediumCVSS 5.4No exploitEPSS 72%

    jenkins · dashboard viewMay 11, 2021

  • CVE-2021-26419
    37Monitor

    Scripting Engine Memory Corruption Vulnerability

    HighCVSS 7.5No exploitEPSS 22%

    microsoft · internet explorerMay 11, 2021

  • CVE-2021-27068
    51Plan

    Visual Studio Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 53%

    microsoft · visual studio 2019May 11, 2021

  • CVE-2021-28474
    50Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 50%

    microsoft · sharepoint foundationMay 11, 2021

  • CVE-2021-28476
    51Plan

    Windows Hyper-V Remote Code Execution Vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 39%

    microsoft · windows 10May 11, 2021

  • CVE-2021-31166
    99Now

    HTTP Protocol Stack Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · windows 10 2004May 11, 2021

  • CVE-2021-31178
    27Monitor

    Microsoft Office Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 16%

    microsoft · 365 appsMay 11, 2021

  • CVE-2021-31179
    35Monitor

    Microsoft Office Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 13%

    microsoft · 365 appsMay 11, 2021

  • CVE-2021-31181
    44Plan

    Microsoft SharePoint Remote Code Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 28%

    microsoft · sharepoint enterprise serverMay 11, 2021

  • CVE-2021-31195
    48Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 73%

    microsoft · exchange serverMay 11, 2021

  • CVE-2021-31207
    86Now

    Microsoft Exchange Server Security Feature Bypass Vulnerability

    MediumCVSS 6.6KEVWeaponizedEPSS 99%

    microsoft · exchange serverMay 11, 2021

  • CVE-2021-31213
    47Plan

    Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 52%

    microsoft · remoteMay 11, 2021

  • CVE-2020-36289
    51Plan

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

    MediumCVSS 5.3Proof of conceptEPSS 99%

    atlassian · data centerMay 12, 2021

  • CVE-2021-32607
    49Plan

    An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1.

    CriticalCVSS 9.8No exploitEPSS 33%

    smartstore · smartstoreMay 12, 2021

  • CVE-2021-32608
    49Plan

    An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1.

    CriticalCVSS 9.8No exploitEPSS 33%

    smartstore · smartstoreMay 12, 2021

  • CVE-2021-30214
    28Monitor

    Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' paramet

    MediumCVSS 5.4No exploitEPSS 23%

    eng · knowageMay 12, 2021

  • CVE-2020-36197
    41Plan

    Improper Access Control Vulnerability in Music Station

    HighCVSS 8.8No exploitEPSS 18%

    qnap · music stationMay 12, 2021

  • CVE-2021-28799
    92Now

    Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

    CriticalCVSS 9.8KEVWeaponizedEPSS 78%

    qnap · hybrid backup syncMay 12, 2021

  • CVE-2021-24284
    52Plan

    Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    kaswara project · kaswaraMay 14, 2021

  • CVE-2021-24285
    43Plan

    Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    cars-seller-auto-classifieds-script project · cars-seller-auto-classifieds-scriptMay 14, 2021

  • CVE-2021-24286
    28Monitor

    Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 13%

    mooveagency · redirect 404 to parentMay 14, 2021

  • CVE-2021-24287
    27Monitor

    Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 10%

    mooveagency · select all categories and taxonomies\, change checkbox to radio buttonsMay 14, 2021

  • CVE-2021-24291
    28Monitor

    Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 14%

    10web · photo galleryMay 14, 2021

  • CVE-2021-32819
    52Plan

    Remote code execution in squirrelly

    HighCVSS 8.8Proof of conceptEPSS 58%

    squirrelly · squirrellyMay 14, 2021

  • CVE-2021-32820
    39Monitor

    File disclosure in Express Handlebars

    HighCVSS 8.6Proof of conceptEPSS 15%

    express handlebars project · express handlebarsMay 14, 2021

  • CVE-2021-3518
    42Plan

    There's a flaw in libxml2 in versions before 2.9.11.

    HighCVSS 8.8No exploitEPSS 21%

    xmlsoft · libxml2May 18, 2021

  • CVE-2021-32305
    65This week

    WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    websvn · websvnMay 18, 2021

  • CVE-2021-31316
    43Plan

    The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    control-webpanel · webpanelMay 18, 2021

  • CVE-2021-31324
    49Plan

    The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    control-webpanel · webpanelMay 18, 2021

  • CVE-2021-3517
    39Monitor

    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.

    HighCVSS 8.6No exploitEPSS 16%

    xmlsoft · libxml2May 19, 2021

  • CVE-2021-29622
    30Monitor

    Arbitrary redirects under /new endpoint

    MediumCVSS 6.1Proof of conceptEPSS 19%

    prometheus · prometheusMay 19, 2021

  • CVE-2020-35580
    34Monitor

    A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrar

    HighCVSS 7.5Proof of conceptEPSS 13%

    searchblox · searchbloxMay 20, 2021

  • CVE-2021-31474
    67This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 202

    CriticalCVSS 9.8No exploitEPSS 93%

    solarwinds · network performance monitorMay 21, 2021

  • CVE-2021-1531
    44Plan

    Cisco Modeling Labs Web UI Command Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 30%

    cisco · modeling labsMay 22, 2021

  • CVE-2021-24300
    27Monitor

    PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 10%

    pickplugins · product slider for woocommerceMay 24, 2021

  • CVE-2021-24307
    51Plan

    All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize

    HighCVSS 8.8Proof of conceptEPSS 53%

    aioseo · all in one seoMay 24, 2021

  • CVE-2020-28901
    43Plan

    Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrup

    CriticalCVSS 9.8No exploitEPSS 11%

    nagios · fusionMay 24, 2021

  • CVE-2020-28903
    28Monitor

    Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary H

    MediumCVSS 6.1No exploitEPSS 13%

    nagios · fusionMay 24, 2021

  • CVE-2020-28905
    43Plan

    Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.

    HighCVSS 8.8No exploitEPSS 26%

    nagios · fusionMay 24, 2021

  • CVE-2021-29256
    66This week

    .

    HighCVSS 8.8KEVWeaponizedEPSS 2%

    arm · bifrost gpu kernel driverMay 24, 2021

  • CVE-2021-21659
    52Plan

    Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    HighCVSS 8.1No exploitEPSS 66%

    jenkins · urltriggerMay 25, 2021

  • CVE-2021-27562
    53Plan

    In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure da

    MediumCVSS 5.5KEVWeaponizedEPSS 3%

    trustedfirmware · trusted firmware-mMay 25, 2021

  • CVE-2021-22160
    55Plan

    Authentication with JWT allows use of “none”-algorithm

    CriticalCVSS 9.8No exploitEPSS 52%

    apache · pulsarMay 26, 2021

  • CVE-2021-21985
    99Now

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · vcenter serverMay 26, 2021

  • CVE-2021-21986
    43Plan

    The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, v

    CriticalCVSS 9.8No exploitEPSS 13%

    vmware · vcenter serverMay 26, 2021

  • CVE-2021-33558
    34Monitor

    Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, l

    HighCVSS 7.5Proof of conceptEPSS 12%

    boa · boaMay 27, 2021

  • CVE-2021-22894
    77This week

    A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary c

    HighCVSS 8.8KEVWeaponizedEPSS 41%

    ivanti · connect secureMay 27, 2021

  • CVE-2021-22899
    72This week

    A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote co

    HighCVSS 8.8KEVWeaponizedEPSS 22%

    ivanti · connect secureMay 27, 2021

  • CVE-2021-22900
    62This week

    A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administra

    HighCVSS 7.2KEVWeaponizedEPSS 14%

    ivanti · connect secureMay 27, 2021

  • CVE-2021-22908
    56Plan

    A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse

    HighCVSS 8.8No exploitEPSS 69%

    ivanti · connect secureMay 27, 2021

  • CVE-2021-22911
    68This week

    A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectio

    CriticalCVSS 9.8Proof of conceptEPSS 95%

    rocket.chat · rocket.chatMay 27, 2021

  • CVE-2021-28662
    48Plan

    An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6.

    MediumCVSS 6.5No exploitEPSS 71%

    squid-cache · squidMay 27, 2021

  • CVE-2021-31535
    42Plan

    LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code.

    CriticalCVSS 9.8No exploitEPSS 10%

    x.org · libx11May 27, 2021

  • CVE-2021-31806
    55Plan

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.

    MediumCVSS 6.5WeaponizedEPSS 95%

    squid-cache · squidMay 27, 2021

  • CVE-2021-20026
    38Monitor

    A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP r

    HighCVSS 8.8No exploitEPSS 11%

    sonicwall · network security managerMay 27, 2021

  • CVE-2021-27852
    78This week

    Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute a

    CriticalCVSS 9.8KEVWeaponizedEPSS 30%

    checkbox · surveyMay 27, 2021

  • CVE-2021-33620
    50Plan

    Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTT

    MediumCVSS 6.5No exploitEPSS 79%

    squid-cache · squidMay 28, 2021

  • CVE-2021-29492
    53Plan

    Bypass of path matching rules using escaped slash characters

    HighCVSS 8.3No exploitEPSS 66%

    envoyproxy · envoyMay 28, 2021

  • CVE-2021-29505
    58Plan

    XStream is vulnerable to a Remote Command Execution attack

    HighCVSS 8.8Proof of conceptEPSS 77%

    xstream · xstreamMay 28, 2021

  • CVE-2021-30461
    50Plan

    A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61.

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    voipmonitor · voipmonitorMay 29, 2021

  • CVE-2021-33564
    61This week

    An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    dragonfly project · dragonflyMay 29, 2021