Top 10 CVEs of 2021
2021
Six data-derived top-10 lists for CVEs published or KEV-added in 2021. No editorial scoring; everything below is computed directly from the ingested corpus.
Top 10 most severe CVEs of 2021
Ranked by CVSS v3 base score, descending. Ties broken by KEV status, then EPSS score, then publish date.
| # | CVE | Severity | CVSS | KEV | Summary |
|---|---|---|---|---|---|
| 1 | CVE-2021-44228 | Critical | 10.0 | KEV | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoin… |
| 2 | CVE-2021-22205 | Critical | 10.0 | KEV | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. |
| 3 | CVE-2021-41277 | Critical | 10.0 | KEV | Metabase is an open source data analytics platform. |
| 4 | CVE-2021-30116 | Critical | 10.0 | KEV | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. |
| 5 | CVE-2021-28799 | Critical | 10.0 | KEV | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. |
| 6 | CVE-2021-22893 | Critical | 10.0 | KEV | Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated… |
| 7 | CVE-2021-21242 | Critical | 10.0 | — | OneDev is an all-in-one devops platform. |
| 8 | CVE-2021-21243 | Critical | 10.0 | — | OneDev is an all-in-one devops platform. |
| 9 | CVE-2021-33032 | Critical | 10.0 | — | A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execu… |
| 10 | CVE-2021-32671 | Critical | 10.0 | — | Flarum is a forum software for building communities. |
Top 10 actively exploited CVEs of 2021
CVEs added to the CISA Known Exploited Vulnerabilities catalog during the year, newest first. Empty for pre-2021 years.
| # | CVE | Severity | CVSS | KEV | Added | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2021-4102 | High | 8.8 | KEV | 2021-12-15 | Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| 2 | CVE-2021-43890 | High | 7.1 | KEV | 2021-12-15 | We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. |
| 3 | CVE-2021-44168 | Low | 3.3 | KEV | 2021-12-10 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packa… |
| 4 | CVE-2021-44515 | Critical | 9.8 | KEV | 2021-12-10 | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. |
| 5 | CVE-2021-44228 | Critical | 10.0 | KEV | 2021-12-10 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoin… |
| 6 | CVE-2021-35394 | Critical | 9.8 | KEV | 2021-12-10 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. |
| 7 | CVE-2020-17463 | Critical | 9.8 | KEV | 2021-12-10 | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. |
| 8 | CVE-2020-8816 | High | 7.2 | KEV | 2021-12-10 | Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. |
| 9 | CVE-2019-10758 | Critical | 9.9 | KEV | 2021-12-10 | mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. |
| 10 | CVE-2019-0193 | High | 7.2 | KEV | 2021-12-10 | In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. |
Top 10 highest-EPSS CVEs of 2021
FIRST.org Exploit Prediction Scoring System scores, descending. EPSS estimates the probability a CVE will be exploited in the next 30 days.
| # | CVE | Severity | CVSS | KEV | EPSS | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2021-44228 | Critical | 10.0 | KEV | 1.000 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoin… |
| 2 | CVE-2021-34473 | Critical | 9.1 | KEV | 1.000 | Microsoft Exchange Server Remote Code Execution Vulnerability |
| 3 | CVE-2021-22005 | Critical | 9.8 | KEV | 1.000 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. |
| 4 | CVE-2021-40438 | Critical | 9.0 | KEV | 1.000 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. |
| 5 | CVE-2021-26084 | Critical | 9.8 | KEV | 1.000 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. |
| 6 | CVE-2021-35464 | Critical | 9.8 | KEV | 1.000 | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. |
| 7 | CVE-2021-21985 | Critical | 9.8 | KEV | 1.000 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. |
| 8 | CVE-2021-26086 | Medium | 5.3 | KEV | 1.000 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. |
| 9 | CVE-2021-26855 | Critical | 9.1 | KEV | 1.000 | Microsoft Exchange Server Remote Code Execution Vulnerability |
| 10 | CVE-2021-45105 | Medium | 5.9 | — | 1.000 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. |
Top 10 most PoC-covered CVEs of 2021
Ranked by the count of indexed public proof-of-concept repositories. Higher counts correlate with weaponisation effort.
| # | CVE | Severity | CVSS | KEV | PoCs | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2021-44228 | Critical | 10.0 | KEV | 2288 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoin… |
| 2 | CVE-2021-41773 | Critical | 9.8 | KEV | 628 | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. |
| 3 | CVE-2021-4034 | High | 7.8 | KEV | 586 | A local privilege escalation vulnerability was found on polkit's pkexec utility. |
| 4 | CVE-2021-3156 | High | 7.8 | KEV | 419 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. |
| 5 | CVE-2021-34527 | High | 8.8 | KEV | 366 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. |
| 6 | CVE-2021-1675 | High | 7.8 | KEV | 361 | Windows Print Spooler Remote Code Execution Vulnerability |
| 7 | CVE-2021-45046 | Critical | 9.0 | KEV | 348 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. |
| 8 | CVE-2021-42013 | Critical | 9.8 | KEV | 265 | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. |
| 9 | CVE-2021-26855 | Critical | 9.1 | KEV | 238 | Microsoft Exchange Server Remote Code Execution Vulnerability |
| 10 | CVE-2021-3560 | High | 7.8 | KEV | 231 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. |
Top 10 most-vulnerable vendors of 2021
Vendors ranked by distinct CVE count for the year. Counts include every CVE attached to any product the vendor ships in our CPE map.
| # | Vendor | CVE count |
|---|---|---|
| 1 | Microsoft | 1848 |
| 2 | 1448 | |
| 3 | Linux | 1172 |
| 4 | Fedoraproject | 1166 |
| 5 | Debian | 1017 |
| 6 | Oracle | 902 |
| 7 | Apple | 795 |
| 8 | Cisco | 617 |
Top 10 most-common CWEs of 2021
CWE classification ids ranked by the count of CVEs published in the year that carry them. Each CVE typically lists 1–3 CWE ids; counts reflect the union of those lists across the year's corpus.
| # | CWE | Name | CVE count |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 2810 |
| 2 | CWE-787 | Out-of-bounds Write | 1665 |
| 3 | CWE-125 | Out-of-bounds Read | 824 |
| 4 | CWE-20 | Improper Input Validation | 817 |
| 5 | CWE-89 | SQL Injection | 797 |
| 6 | CWE-416 | Use After Free | 792 |
| 7 | CWE-22 | Path Traversal | 581 |
| 8 | CWE-476 | NULL Pointer Dereference | 565 |
| 9 | CWE-78 | OS Command Injection | 517 |
| 10 | CWE-352 | Cross-Site Request Forgery (CSRF) | 512 |