Known exploited vulnerabilities

Attackers can break into vulnerable password self-service servers over the internet and use them as a launch point to steal access or deploy ransomware

A malicious PDF can take control of a user’s computer if opened with an outdated Adobe Acrobat or Reader installation

Attackers can break into vulnerable Confluence servers from the network without a password and take control of the system

An outdated Apple device could let a malicious app take full control of the device, so affected iPhones, iPads, and Macs should be updated immediately

Attackers can compromise an unpatched Apple device by getting it to open malicious web content, which may allow theft of sensitive data or surveillance

Some routers and access points can be taken over remotely through their built-in web management page if they have not received a vendor firmware fix

An attacker who already gets limited access to an unpatched Windows computer can turn that access into full control of the machine

Attackers can trick Windows servers into proving their identity to the attacker, which can help them break into the wider company network and support…

An attacker who can sign in to the security management console may be able to upload malicious files and take control of the server that manages endpoint…

An attacker who already has limited access to a Windows computer can use a flaw in Trend Micro security software to gain full control of that machine

A flaw in an older access management server can let outsiders take control of it without a password, putting logins, sensitive data, and connected systems at…

A malicious web page or document can take control of an unpatched Windows computer after a user opens it. CVE-2021-34448 is rated medium (CVSS 6.8), is listed…

Attackers can take over vulnerable SolarWinds file-transfer servers remotely, potentially stealing files and using the server as a foothold for ransomware or…

Attackers can abuse unpatched Microsoft Exchange servers to gain control of email systems, steal sensitive messages, and potentially deploy ransomware

An exposed email server that is not updated can be remotely taken over by attackers and used as a gateway for data theft or ransomware

An attacker who already gets a small foothold on an unpatched Windows computer can use this flaw to take full control of it

A flaw in Windows can let an attacker who already got onto a computer take full control of it unless the system has been updated

A flaw in Kaseya’s remote management software can let attackers get access to the management system and use it to attack many computers at once

A weakness in Windows printing can let an attacker take full control of a computer and use it to spread or deploy ransomware if it is not patched and locked…

A malicious web page or document can take over an unpatched Windows computer when a user opens it. CVE-2021-33742 is rated high (CVSS 7.5), is listed in CISA…

An attacker who has already gotten code to run on an unpatched Windows computer can use this flaw to take full control of that machine

Windows Print Spooler Remote Code Execution Vulnerability. CVE-2021-1675 is rated high (CVSS 7.8) and is listed in CISA KEV.

A flaw in Windows can let someone who already has limited access gain more control over the computer if it has not been updated

An attacker who already gets onto an unpatched Windows computer could use this flaw to gain more control over that machine

An attacker who already gets a basic foothold on an unpatched Windows computer can use this flaw to take full control of it

An attacker who already gets a small foothold on an unpatched Windows computer may be able to use this weakness to help take full control of it

An attacker with a valid VPN login could take control of vulnerable remote-access appliances and use them as a doorway into the organization’s network

An attacker with a valid login could take full control of a vulnerable VPN gateway and use it to access internal systems

An attacker with administrator access to the VPN appliance could upload a specially made file that changes the appliance and may let them take it over

Attackers can take over vulnerable VMware management servers remotely and use that access to disrupt or control the virtual machines they manage

Some affected device firmware can be crashed or made to mishandle protected information by code already running on the device, so impacted products need a…

Attackers can abuse vulnerable Exchange email servers to break in, steal data, and deploy ransomware if the servers are not fully updated

Some devices with Arm graphics chips can let a malicious app take full control of the device unless the vendor’s security update has been installed

A flaw in some Arm graphics drivers can let a malicious app or low-privileged program take over a device if it has not been updated

Certain Tenda routers can be taken over remotely if their management interface is reachable, allowing attackers to control network traffic or disrupt…

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Some Qualcomm-based devices can be deliberately made unstable or unusable by a local app or process until they are updated

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command…

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command…

A flaw in some Buffalo routers can let outsiders reach the router’s control pages without a password, putting network settings and connectivity at risk

A malicious web page could take over an outdated browser, so affected systems should be updated immediately. CVE-2021-21206 is rated high (CVSS 8.8), affects…

A malicious web page could take over an out-of-date browser when someone visits it, putting the device and its data at risk

A malicious website could take over a vulnerable browser when someone visits it, putting their device and data at risk

A flaw in vulnerable remote-access VPN gateways can let attackers break in without a password and use that access to steal data or launch further attacks

A flaw in SonicWall email security systems could let a logged-in attacker read sensitive files and use that information to support a larger breach or…

A flaw in Windows can let someone who already gets limited access to a computer take full control of it unless the system is patched

Attackers can remotely create their own administrator account on affected SonicWall email security systems and take control of how email is inspected, routed…

A flaw in SonicWall’s email security product can let a logged-in attacker place malicious files on the system, potentially leading to email data theft, service…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001…