{ "query": { "exploited": "1", "page": "44" }, "count": 20, "total": 1734, "page": 44, "limit": 20, "updated": { "cves": "2026-10-07T16:47:45.059Z", "kev": "2026-10-07T17:46:46.967Z", "epss": "2026-10-07T12:59:36.323Z", "breaches": "2026-10-07T12:47:35.891Z", "posts": "2026-10-07T17:47:47.210Z" }, "links": { "web": "https://spydr.io/threats?exploited=1&page=44", "next": "https://spydr.io/threats.json?exploited=1&page=45" }, "coverage": { "cves_published_since": "2026-06-09", "days": 120, "also": "every CVE in CISA KEV" }, "unscored_hidden": 0, "warnings": [], "results": [ { "id": "CVE-2021-20124", "url": "https://spydr.io/cve/CVE-2021-20124", "published": "2021-10-13T16:15:07.397Z", "modified": "2026-06-17T03:33:18.783Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.96308, "epss_percentile": 0.9988, "exploited": true, "kev": { "added": "2024-09-03", "due": "2024-09-24", "action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "draytek" ], "products": [ "Draytek VigorConnect" ], "cwes": [ "CWE-22" ], "description": "A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges." }, { "id": "CVE-2021-20123", "url": "https://spydr.io/cve/CVE-2021-20123", "published": "2021-10-13T16:15:07.350Z", "modified": "2026-06-17T03:33:18.627Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.90234, "epss_percentile": 0.99797, "exploited": true, "kev": { "added": "2024-09-03", "due": "2024-09-24", "action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "draytek" ], "products": [ "Draytek VigorConnect" ], "cwes": [ "CWE-22" ], "description": "A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges." }, { "id": "CVE-2021-41357", "url": "https://spydr.io/cve/CVE-2021-41357", "published": "2021-10-13T01:15:13.950Z", "modified": "2026-06-17T04:08:24.537Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.01582, "epss_percentile": 0.74738, "exploited": true, "kev": { "added": "2022-04-25", "due": "2022-05-16", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2022", "Microsoft Windows 10 Version 2004", "Microsoft Windows Server version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows Server version 20H2", "Microsoft Windows 11 version 21H2" ], "cwes": [], "description": "Win32k Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-40450", "url": "https://spydr.io/cve/CVE-2021-40450", "published": "2021-10-13T01:15:09.750Z", "modified": "2026-06-17T04:06:56.627Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.01582, "epss_percentile": 0.74737, "exploited": true, "kev": { "added": "2022-04-25", "due": "2022-05-16", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2022", "Microsoft Windows 10 Version 2004", "Microsoft Windows Server version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows Server version 20H2", "Microsoft Windows 11 version 21H2" ], "cwes": [], "description": "Win32k Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-40449", "url": "https://spydr.io/cve/CVE-2021-40449", "published": "2021-10-13T01:15:09.703Z", "modified": "2026-06-17T04:06:56.427Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.74129, "epss_percentile": 0.99476, "exploited": true, "kev": { "added": "2021-11-17", "due": "2021-12-01", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2022", "Microsoft Windows 10 Version 2004", "Microsoft Windows Server version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows Server version 20H2", "Microsoft Windows 11 version 21H2", "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows 7", "Microsoft Windows 7 Service Pack 1", "Microsoft Windows 8.1", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)" ], "cwes": [ "CWE-416" ], "description": "Win32k Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-37976", "url": "https://spydr.io/cve/CVE-2021-37976", "published": "2021-10-08T22:15:08.417Z", "modified": "2026-06-17T04:01:20.387Z", "score": 6.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.19901, "epss_percentile": 0.97361, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-862" ], "description": "Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page." }, { "id": "CVE-2021-37975", "url": "https://spydr.io/cve/CVE-2021-37975", "published": "2021-10-08T22:15:08.373Z", "modified": "2026-06-17T04:01:20.160Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.34887, "epss_percentile": 0.98395, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-416" ], "description": "Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." }, { "id": "CVE-2021-37973", "url": "https://spydr.io/cve/CVE-2021-37973", "published": "2021-10-08T22:15:08.287Z", "modified": "2026-06-17T04:01:19.780Z", "score": 9.6, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.11735, "epss_percentile": 0.95965, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-416" ], "description": "Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page." }, { "id": "CVE-2021-30633", "url": "https://spydr.io/cve/CVE-2021-30633", "published": "2021-10-08T21:15:07.650Z", "modified": "2026-06-17T03:50:36.010Z", "score": 9.6, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.3318, "epss_percentile": 0.98328, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-416" ], "description": "Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page." }, { "id": "CVE-2021-30632", "url": "https://spydr.io/cve/CVE-2021-30632", "published": "2021-10-08T21:15:07.603Z", "modified": "2026-06-17T03:50:35.847Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.6319, "epss_percentile": 0.99186, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-787" ], "description": "Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." }, { "id": "CVE-2021-42013", "url": "https://spydr.io/cve/CVE-2021-42013", "published": "2021-10-07T16:15:09.270Z", "modified": "2026-06-17T04:09:09.193Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99964, "epss_percentile": 0.99976, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Apache Software Foundation" ], "products": [ "Apache Software Foundation Apache HTTP Server" ], "cwes": [ "CWE-22" ], "description": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions." }, { "id": "CVE-2021-25489", "url": "https://spydr.io/cve/CVE-2021-25489", "published": "2021-10-06T18:15:09.667Z", "modified": "2026-06-17T03:42:10.737Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "NVD", "epss": 0.00531, "epss_percentile": 0.42964, "exploited": true, "kev": { "added": "2023-06-29", "due": "2023-07-20", "action": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Samsung Mobile" ], "products": [ "Samsung Mobile Devices" ], "cwes": [ "CWE-20", "CWE-134" ], "description": "Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic." }, { "id": "CVE-2021-25487", "url": "https://spydr.io/cve/CVE-2021-25487", "published": "2021-10-06T18:15:09.567Z", "modified": "2026-06-17T03:42:10.500Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.00635, "epss_percentile": 0.48724, "exploited": true, "kev": { "added": "2023-06-29", "due": "2023-07-20", "action": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Samsung Mobile" ], "products": [ "Samsung Mobile Devices" ], "cwes": [ "CWE-125" ], "description": "Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer." }, { "id": "CVE-2021-39226", "url": "https://spydr.io/cve/CVE-2021-39226", "published": "2021-10-05T18:15:07.947Z", "modified": "2026-06-17T04:03:21.130Z", "score": 7.3, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "score_source": "NVD", "epss": 0.99933, "epss_percentile": 0.9997, "exploited": true, "kev": { "added": "2022-08-25", "due": "2022-09-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "grafana" ], "products": [ "grafana" ], "cwes": [ "CWE-287", "CWE-862" ], "description": "Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot \"public_mode\" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot \"public_mode\" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects." }, { "id": "CVE-2021-41773", "url": "https://spydr.io/cve/CVE-2021-41773", "published": "2021-10-05T09:15:07.593Z", "modified": "2026-06-17T04:08:53.933Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99992, "epss_percentile": 0.99986, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Apache Software Foundation" ], "products": [ "Apache Software Foundation Apache HTTP Server" ], "cwes": [ "CWE-22" ], "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013." }, { "id": "CVE-2021-20035", "url": "https://spydr.io/cve/CVE-2021-20035", "published": "2021-09-27T18:15:08.383Z", "modified": "2026-06-17T03:33:11.067Z", "score": 6.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "NVD", "epss": 0.04181, "epss_percentile": 0.90638, "exploited": true, "kev": { "added": "2025-04-16", "due": "2025-05-07", "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "SonicWall" ], "products": [ "SonicWall SMA100" ], "cwes": [ "CWE-78" ], "description": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS." }, { "id": "CVE-2021-40655", "url": "https://spydr.io/cve/CVE-2021-40655", "published": "2021-09-24T21:15:07.310Z", "modified": "2026-06-17T04:07:13.547Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.86659, "epss_percentile": 0.99737, "exploited": true, "kev": { "added": "2024-05-16", "due": "2024-06-06", "action": "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "dlink" ], "products": [ "dlink dir-605l_firmware", "dlink dir-605l" ], "cwes": [ "CWE-863" ], "description": "An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page" }, { "id": "CVE-2021-22941", "url": "https://spydr.io/cve/CVE-2021-22941", "published": "2021-09-23T13:15:08.620Z", "modified": "2026-06-17T03:38:04.350Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.53585, "epss_percentile": 0.98967, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "citrix" ], "products": [ "Citrix ShareFile storage zones controller" ], "cwes": [ "CWE-284" ], "description": "Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller." }, { "id": "CVE-2021-22017", "url": "https://spydr.io/cve/CVE-2021-22017", "published": "2021-09-23T13:15:08.207Z", "modified": "2026-06-17T03:36:33.670Z", "score": 5.3, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "score_source": "NVD", "epss": 0.49177, "epss_percentile": 0.98856, "exploited": true, "kev": { "added": "2022-01-10", "due": "2022-01-24", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "vmware" ], "products": [ "VMware vCenter Server, VMware Cloud Foundation" ], "cwes": [], "description": "Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed." }, { "id": "CVE-2021-22005", "url": "https://spydr.io/cve/CVE-2021-22005", "published": "2021-09-23T12:15:07.707Z", "modified": "2026-06-17T03:36:32.447Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99999, "epss_percentile": 0.99997, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "vmware" ], "products": [ "VMware vCenter Server, VMware Cloud Foundation" ], "cwes": [ "CWE-22" ], "description": "The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }