{
  "query": {
    "exploited": "1",
    "page": "51"
  },
  "count": 20,
  "total": 1734,
  "page": 51,
  "limit": 20,
  "updated": {
    "cves": "2026-10-08T00:48:40.801Z",
    "kev": "2026-10-08T01:49:42.842Z",
    "epss": "2026-10-08T01:00:40.923Z",
    "breaches": "2026-10-08T00:48:40.536Z",
    "posts": "2026-10-08T01:48:43.051Z"
  },
  "links": {
    "web": "https://spydr.io/threats?exploited=1&page=51",
    "next": "https://spydr.io/threats.json?exploited=1&page=52"
  },
  "coverage": {
    "cves_published_since": "2026-06-10",
    "days": 120,
    "also": "every CVE in CISA KEV"
  },
  "unscored_hidden": 0,
  "warnings": [],
  "results": [
    {
      "id": "CVE-2021-25370",
      "url": "https://spydr.io/cve/CVE-2021-25370",
      "published": "2021-03-26T19:15:12.147Z",
      "modified": "2026-06-17T03:41:57.440Z",
      "score": 4.4,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "score_source": "NVD",
      "epss": 0.0089,
      "epss_percentile": 0.58104,
      "exploited": true,
      "kev": {
        "added": "2022-11-08",
        "due": "2022-11-29",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Samsung Mobile"
      ],
      "products": [
        "Samsung Mobile Devices"
      ],
      "cwes": [
        "CWE-416",
        "CWE-703"
      ],
      "description": "An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic."
    },
    {
      "id": "CVE-2021-25369",
      "url": "https://spydr.io/cve/CVE-2021-25369",
      "published": "2021-03-26T19:15:12.040Z",
      "modified": "2026-06-17T03:41:57.293Z",
      "score": 5.5,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "NVD",
      "epss": 0.01079,
      "epss_percentile": 0.6401,
      "exploited": true,
      "kev": {
        "added": "2022-11-08",
        "due": "2022-11-29",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Samsung Mobile"
      ],
      "products": [
        "Samsung Mobile Devices"
      ],
      "cwes": [
        "CWE-200"
      ],
      "description": "An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace."
    },
    {
      "id": "CVE-2021-22506",
      "url": "https://spydr.io/cve/CVE-2021-22506",
      "published": "2021-03-26T14:15:11.967Z",
      "modified": "2026-06-17T03:37:20.860Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "NVD",
      "epss": 0.25695,
      "epss_percentile": 0.9792,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "microfocus"
      ],
      "products": [
        "Access Manager."
      ],
      "cwes": [],
      "description": "Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage."
    },
    {
      "id": "CVE-2021-21193",
      "url": "https://spydr.io/cve/CVE-2021-21193",
      "published": "2021-03-16T15:15:13.157Z",
      "modified": "2026-06-17T03:35:00.483Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.0987,
      "epss_percentile": 0.95456,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Google"
      ],
      "products": [
        "Google Chrome"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."
    },
    {
      "id": "CVE-2021-27085",
      "url": "https://spydr.io/cve/CVE-2021-27085",
      "published": "2021-03-11T16:15:18.677Z",
      "modified": "2026-08-19T19:22:43.240Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
      "score_source": "microsoft.com",
      "epss": 0.05448,
      "epss_percentile": 0.92521,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Internet Explorer 11"
      ],
      "cwes": [],
      "description": "Internet Explorer Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-27059",
      "url": "https://spydr.io/cve/CVE-2021-27059",
      "published": "2021-03-11T16:15:17.583Z",
      "modified": "2026-08-19T19:22:31.700Z",
      "score": 7.6,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.06076,
      "epss_percentile": 0.93213,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Office 2010 Service Pack 2",
        "Microsoft Office 2013 Service Pack 1",
        "Microsoft Office 2016"
      ],
      "cwes": [],
      "description": "Microsoft Office Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-26411",
      "url": "https://spydr.io/cve/CVE-2021-26411",
      "published": "2021-03-11T16:15:13.863Z",
      "modified": "2026-10-01T21:17:16.540Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
      "score_source": "microsoft.com",
      "epss": 0.80765,
      "epss_percentile": 0.99622,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Internet Explorer 11",
        "Microsoft Internet Explorer 9",
        "Microsoft Edge (EdgeHTML-based)"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Internet Explorer Memory Corruption Vulnerability"
    },
    {
      "id": "CVE-2021-21166",
      "url": "https://spydr.io/cve/CVE-2021-21166",
      "published": "2021-03-09T18:15:16.297Z",
      "modified": "2026-06-17T03:34:57.070Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.24027,
      "epss_percentile": 0.9779,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Google"
      ],
      "products": [
        "Google Chrome"
      ],
      "cwes": [
        "CWE-362"
      ],
      "description": "Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."
    },
    {
      "id": "CVE-2021-25337",
      "url": "https://spydr.io/cve/CVE-2021-25337",
      "published": "2021-03-04T21:15:13.667Z",
      "modified": "2026-06-17T03:41:53.733Z",
      "score": 7.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "score_source": "NVD",
      "epss": 0.02807,
      "epss_percentile": 0.86077,
      "exploited": true,
      "kev": {
        "added": "2022-11-08",
        "due": "2022-11-29",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Samsung Mobile"
      ],
      "products": [
        "Samsung Mobile Devices"
      ],
      "cwes": [
        "CWE-269"
      ],
      "description": "Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files."
    },
    {
      "id": "CVE-2021-22681",
      "url": "https://spydr.io/cve/CVE-2021-22681",
      "published": "2021-03-03T18:15:14.643Z",
      "modified": "2026-06-17T03:37:34.183Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.6363,
      "epss_percentile": 0.99198,
      "exploited": true,
      "kev": {
        "added": "2026-03-05",
        "due": "2026-03-26",
        "action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "rockwellautomation"
      ],
      "products": [
        "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers"
      ],
      "cwes": [
        "CWE-522"
      ],
      "description": "Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800."
    },
    {
      "id": "CVE-2021-27065",
      "url": "https://spydr.io/cve/CVE-2021-27065",
      "published": "2021-03-03T00:15:12.307Z",
      "modified": "2026-10-01T21:17:17.040Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.99876,
      "epss_percentile": 0.99963,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Exchange Server 2013 Cumulative Update 21",
        "Microsoft Exchange Server 2013 Cumulative Update 22",
        "Microsoft Exchange Server 2013 Cumulative Update 23",
        "Microsoft Exchange Server 2013 Service Pack 1",
        "Microsoft Exchange Server 2016 Cumulative Update 10",
        "Microsoft Exchange Server 2016 Cumulative Update 11",
        "Microsoft Exchange Server 2016 Cumulative Update 12",
        "Microsoft Exchange Server 2016 Cumulative Update 13",
        "Microsoft Exchange Server 2016 Cumulative Update 14",
        "Microsoft Exchange Server 2016 Cumulative Update 15",
        "Microsoft Exchange Server 2016 Cumulative Update 16",
        "Microsoft Exchange Server 2016 Cumulative Update 17",
        "Microsoft Exchange Server 2016 Cumulative Update 18",
        "Microsoft Exchange Server 2016 Cumulative Update 19",
        "Microsoft Exchange Server 2016 Cumulative Update 8",
        "Microsoft Exchange Server 2016 Cumulative Update 9",
        "Microsoft Exchange Server 2019",
        "Microsoft Exchange Server 2019 Cumulative Update 1",
        "Microsoft Exchange Server 2019 Cumulative Update 2",
        "Microsoft Exchange Server 2019 Cumulative Update 3"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-26858",
      "url": "https://spydr.io/cve/CVE-2021-26858",
      "published": "2021-03-03T00:15:12.227Z",
      "modified": "2026-10-01T21:17:16.777Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.93651,
      "epss_percentile": 0.99842,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Exchange Server 2013 Cumulative Update 21",
        "Microsoft Exchange Server 2013 Cumulative Update 22",
        "Microsoft Exchange Server 2013 Cumulative Update 23",
        "Microsoft Exchange Server 2016 Cumulative Update 10",
        "Microsoft Exchange Server 2016 Cumulative Update 11",
        "Microsoft Exchange Server 2016 Cumulative Update 12",
        "Microsoft Exchange Server 2016 Cumulative Update 13",
        "Microsoft Exchange Server 2016 Cumulative Update 14",
        "Microsoft Exchange Server 2016 Cumulative Update 15",
        "Microsoft Exchange Server 2016 Cumulative Update 16",
        "Microsoft Exchange Server 2016 Cumulative Update 17",
        "Microsoft Exchange Server 2016 Cumulative Update 18",
        "Microsoft Exchange Server 2016 Cumulative Update 19",
        "Microsoft Exchange Server 2016 Cumulative Update 8",
        "Microsoft Exchange Server 2016 Cumulative Update 9",
        "Microsoft Exchange Server 2019",
        "Microsoft Exchange Server 2019 Cumulative Update 1",
        "Microsoft Exchange Server 2019 Cumulative Update 2",
        "Microsoft Exchange Server 2019 Cumulative Update 3",
        "Microsoft Exchange Server 2019 Cumulative Update 4"
      ],
      "cwes": [],
      "description": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-26857",
      "url": "https://spydr.io/cve/CVE-2021-26857",
      "published": "2021-03-03T00:15:12.167Z",
      "modified": "2026-08-19T19:22:27.153Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.95762,
      "epss_percentile": 0.99872,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Exchange Server 2010 Service Pack 3",
        "Microsoft Exchange Server 2013 Cumulative Update 21",
        "Microsoft Exchange Server 2013 Cumulative Update 22",
        "Microsoft Exchange Server 2013 Cumulative Update 23",
        "Microsoft Exchange Server 2013 Service Pack 1",
        "Microsoft Exchange Server 2016 Cumulative Update 10",
        "Microsoft Exchange Server 2016 Cumulative Update 11",
        "Microsoft Exchange Server 2016 Cumulative Update 12",
        "Microsoft Exchange Server 2016 Cumulative Update 13",
        "Microsoft Exchange Server 2016 Cumulative Update 14",
        "Microsoft Exchange Server 2016 Cumulative Update 15",
        "Microsoft Exchange Server 2016 Cumulative Update 16",
        "Microsoft Exchange Server 2016 Cumulative Update 17",
        "Microsoft Exchange Server 2016 Cumulative Update 18",
        "Microsoft Exchange Server 2016 Cumulative Update 19",
        "Microsoft Exchange Server 2016 Cumulative Update 8",
        "Microsoft Exchange Server 2016 Cumulative Update 9",
        "Microsoft Exchange Server 2019",
        "Microsoft Exchange Server 2019 Cumulative Update 1",
        "Microsoft Exchange Server 2019 Cumulative Update 2"
      ],
      "cwes": [
        "CWE-502"
      ],
      "description": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-26855",
      "url": "https://spydr.io/cve/CVE-2021-26855",
      "published": "2021-03-03T00:15:12.103Z",
      "modified": "2026-08-19T19:22:24.100Z",
      "score": 9.1,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "score_source": "microsoft.com",
      "epss": 0.99996,
      "epss_percentile": 0.99989,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Exchange Server 2013 Cumulative Update 21",
        "Microsoft Exchange Server 2013 Cumulative Update 22",
        "Microsoft Exchange Server 2013 Cumulative Update 23",
        "Microsoft Exchange Server 2016 Cumulative Update 10",
        "Microsoft Exchange Server 2016 Cumulative Update 11",
        "Microsoft Exchange Server 2016 Cumulative Update 12",
        "Microsoft Exchange Server 2016 Cumulative Update 13",
        "Microsoft Exchange Server 2016 Cumulative Update 14",
        "Microsoft Exchange Server 2016 Cumulative Update 15",
        "Microsoft Exchange Server 2016 Cumulative Update 16",
        "Microsoft Exchange Server 2016 Cumulative Update 17",
        "Microsoft Exchange Server 2016 Cumulative Update 18",
        "Microsoft Exchange Server 2016 Cumulative Update 19",
        "Microsoft Exchange Server 2016 Cumulative Update 8",
        "Microsoft Exchange Server 2016 Cumulative Update 9",
        "Microsoft Exchange Server 2019",
        "Microsoft Exchange Server 2019 Cumulative Update 1",
        "Microsoft Exchange Server 2019 Cumulative Update 2",
        "Microsoft Exchange Server 2019 Cumulative Update 3",
        "Microsoft Exchange Server 2019 Cumulative Update 4"
      ],
      "cwes": [
        "CWE-918"
      ],
      "description": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "id": "CVE-2021-27878",
      "url": "https://spydr.io/cve/CVE-2021-27878",
      "published": "2021-03-01T22:15:14.537Z",
      "modified": "2026-06-17T03:45:33.063Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.23952,
      "epss_percentile": 0.97783,
      "exploited": true,
      "kev": {
        "added": "2023-04-07",
        "due": "2023-04-28",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "veritas"
      ],
      "products": [
        "veritas backup exec"
      ],
      "cwes": [],
      "description": "An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges."
    },
    {
      "id": "CVE-2021-27877",
      "url": "https://spydr.io/cve/CVE-2021-27877",
      "published": "2021-03-01T22:15:14.460Z",
      "modified": "2026-06-17T03:45:32.920Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.6491,
      "epss_percentile": 0.99233,
      "exploited": true,
      "kev": {
        "added": "2023-04-07",
        "due": "2023-04-28",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "veritas"
      ],
      "products": [
        "veritas backup exec"
      ],
      "cwes": [],
      "description": "An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands."
    },
    {
      "id": "CVE-2021-27876",
      "url": "https://spydr.io/cve/CVE-2021-27876",
      "published": "2021-03-01T22:15:14.350Z",
      "modified": "2026-06-17T03:45:32.780Z",
      "score": 8.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "score_source": "NVD",
      "epss": 0.13518,
      "epss_percentile": 0.96357,
      "exploited": true,
      "kev": {
        "added": "2023-04-07",
        "due": "2023-04-28",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "veritas"
      ],
      "products": [
        "veritas backup exec"
      ],
      "cwes": [],
      "description": "An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges."
    },
    {
      "id": "CVE-2021-1732",
      "url": "https://spydr.io/cve/CVE-2021-1732",
      "published": "2021-02-25T23:15:13.930Z",
      "modified": "2026-08-12T05:17:32.590Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "microsoft.com",
      "epss": 0.78376,
      "epss_percentile": 0.99574,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows 10 Version 1803",
        "Microsoft Windows 10 Version 1809",
        "Microsoft Windows Server 2019",
        "Microsoft Windows Server 2019 (Server Core installation)",
        "Microsoft Windows 10 Version 1909",
        "Microsoft Windows Server, version 1909 (Server Core installation)",
        "Microsoft Windows 10 Version 2004",
        "Microsoft Windows Server version 2004",
        "Microsoft Windows 10 Version 20H2",
        "Microsoft Windows Server version 20H2"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Windows Win32k Elevation of Privilege Vulnerability"
    },
    {
      "id": "CVE-2021-21973",
      "url": "https://spydr.io/cve/CVE-2021-21973",
      "published": "2021-02-24T17:15:15.923Z",
      "modified": "2026-06-17T03:36:28.910Z",
      "score": 5.3,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "score_source": "NVD",
      "epss": 0.88012,
      "epss_percentile": 0.99763,
      "exploited": true,
      "kev": {
        "added": "2022-03-07",
        "due": "2022-03-21",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "vmware"
      ],
      "products": [
        "VMware vCenter Server",
        "VMware Cloud Foundation"
      ],
      "cwes": [
        "CWE-918"
      ],
      "description": "The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2)."
    },
    {
      "id": "CVE-2021-21972",
      "url": "https://spydr.io/cve/CVE-2021-21972",
      "published": "2021-02-24T17:15:15.833Z",
      "modified": "2026-08-12T05:17:35.260Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99865,
      "epss_percentile": 0.99962,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2021-11-17",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "vmware"
      ],
      "products": [
        "VMware vCenter Server",
        "VMware Cloud Foundation"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2)."
    }
  ],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}