Exploited in the wild

Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache <= 2.4.48 Mod_Proxy - Server-Side Request ForgeryCVE-2021-40438Apache Software Foundation · CVSS 9 · 100% likely

   CWE-918Apache1 bounty report

2. VMware vCenter Server - Arbitrary File UploadCVE-2021-22005VMware · CVSS 9.8 · 100% likely

   CWE-22VMware

3. Dahua IPC/VTH/VTO - Authentication BypassCVE-2021-33044Dahua · CVSS 9.8 · 100% likelycovered by CyberSIXT

   CWE-287Dahua3 articles

4. Microsoft Open Management Infrastructure - Remote Code ExecutionCVE-2021-38647Microsoft · CVSS 9.8 · 100% likely

   Microsoft

5. Hikvision IP camera/NVR - Remote Command ExecutionCVE-2021-36260Hikvision · CVSS 9.8 · 100% likelycovered by CyberSIXT

   CWE-78Hikvision1 article

6. Zoho ManageEngine ServiceDesk Plus - Authentication BypassCVE-2021-37415Zoho · CVSS 9.8 · 100% likely

   CWE-306Zoho (ManageEngine)

7. Dahua IPC/VTH/VTO - Authentication BypassCVE-2021-33045Dahua · CVSS 9.8 · 100% likelycovered by CyberSIXT

   CWE-287Dahua3 articles

8. Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command ExecutionCVE-2021-40539Zoho · CVSS 9.8 · 99% likely

   CWE-706Zoho (ManageEngine)

9. Microsoft MSHTML Remote Code Execution VulnerabilityCVE-2021-40444Microsoft · CVSS 8.8 · 98% likely

   CWE-22MicrosoftEXOTIC LILY

10. Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command ExecutionCVE-2021-40870Aviatrix · CVSS 9.8 · 93% likely

    CWE-23Aviatrix2 bounty reports

11. D-Link DIR-605 - Information DisclosureCVE-2021-40655D-Link · CVSS 7.5 · 87% likely

    CWE-863D-Link

12. Delta Electronics DOPSoft 2 Out-of-Bounds WriteCVE-2021-38406Delta Electronics · CVSS 7.8 · 76% likely

    CWE-787Delta Electronics

13. A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gateke…CVE-2021-30657Apple · CVSS 5.5 · 69% likely

    CWE-862Apple

14. Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.CVE-2021-22941Citrix · CVSS 9.8 · 54% likely

    CWE-284Citrix (NetScaler)

15. Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionCVE-2021-28550Adobe · CVSS 9.6 · 52% likely

    CWE-416Adobe

16. vCenter Server - Improper Access ControlCVE-2021-22017VMware · CVSS 5.3 · 49% likely

    VMware

17. SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file o…CVE-2021-38163SAP SE · CVSS 9.9 · 37% likely

    CWE-22SAP

18. Open Management Infrastructure Elevation of Privilege VulnerabilityCVE-2021-38648Microsoft · CVSS 7.8 · 11% likely

    Microsoft

19. A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code exec…CVE-2021-30762Apple · CVSS 8.8 · 11% likely

    CWE-416Apple

20. A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code ex…CVE-2021-30761Apple · CVSS 8.8 · 11% likely

    CWE-787Apple

21. Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityCVE-2021-38646Microsoft · CVSS 7.8 · 8.0% likely

    Microsoft

22. A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is…CVE-2021-30713Apple · CVSS 7.8 · 7.0% likely

    CWE-862Apple

23. A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big S…CVE-2021-30661Apple · CVSS 8.8 · 4.5% likely

    CWE-416Apple

24. Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potenti…CVE-2021-20035SonicWall · CVSS 6.5 · 4.4% likely

    CWE-78SonicWall

25. Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2021-36955Microsoft · CVSS 7.8 · 4.1% likely

    Microsoft

26. A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11…CVE-2021-30665Apple · CVSS 8.8 · 3.7% likely

    CWE-787Apple

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.