VIR Vulnerability Intelligence Relay

CVEs from 2021

6,257 normalized CVEs published or assigned in this year.

Total
6,257
critical
critical 272
high
high 976
medium
medium 1,141
low
low 135
% Critical
4.3%
% with KEV
3.4%
% with exploit
3.4%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-39935 high — 9.5 4mo ago GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. arch
CVE-2021-22555 high — 9.5 8mo ago Important: kernel security, bug fix, and enhancement update archsuserockylinuxdebian
CVE-2021-43798 high — 9.5 2y ago Grafana contains a path traversal vulnerability that could allow access to local files. archsusegolang
CVE-2021-3560 high — 9.5 3y ago Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. archsuserockylinuxdebian
CVE-2021-30533 high — 9.5 4y ago Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could a… archdebian
CVE-2021-4034 high — 9.5 4y ago Important: polkit security update archsuserockylinuxdebian
CVE-2021-0920 high — 9.5 4y ago Important: kernel security, bug fix, and enhancement update suserockylinuxdebian
CVE-2021-40438 high — 9.5 5y ago Important: httpd:2.4 security update debianarchsuserockylinux
CVE-2021-37976 high — 9.5 5y ago Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a c… archdebian
CVE-2021-41773 high — 9.5 5y ago Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under defa… debianarchsuse
CVE-2021-21206 high — 9.5 5y ago Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple we… archdebian
CVE-2021-21220 high — 9.5 5y ago Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could af… archdebian
CVE-2021-37973 high — 9.5 5y ago Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML pag… archdebian
CVE-2021-37975 high — 9.5 5y ago Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multipl… archdebian
CVE-2021-30632 high — 9.5 5y ago Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect m… archdebian
CVE-2021-30554 high — 9.5 5y ago Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple we… archdebian
CVE-2021-38003 high — 9.5 5y ago Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that … archdebian
CVE-2021-30563 high — 9.5 5y ago Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multipl… archdebian
CVE-2021-30633 high — 9.5 5y ago Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted H… archdebian
CVE-2021-21193 high — 9.5 5y ago Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple we… archdebian
CVE-2021-21224 high — 9.5 5y ago Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web … archdebian
CVE-2021-38000 high — 9.5 5y ago Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could a… archdebian
CVE-2021-21166 high — 9.5 5y ago Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web brow… archdebian
CVE-2021-39226 high — 9.5 5y ago Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. archsuserockylinuxgolang