Skip to content

October 2021 · Band 4

Possible (1 to 10%)

711 CVEs

Each square is a CVE that EPSS puts between 1% and 10%.

Every one of the 711 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37931Zohocorp · 9.5% likely

    CWE-434Zoho (ManageEngine)

  2. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37930Zohocorp · 9.5% likely

    CWE-434Zoho (ManageEngine)

  3. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37929Zohocorp · 9.5% likely

    CWE-434Zoho (ManageEngine)

  4. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37928Zohocorp · 9.5% likely

    CWE-434Zoho (ManageEngine)

  5. Ops CLI Deserialization of Untrusted Data leads to Abritrary Code ExecutionCVE-2021-40720Adobe · CVSS 9.8 · 9.5% likely

    CWE-502Adobe

  6. This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability…CVE-2021-34859TeamViewer · CVSS 7.8 · 8.9% likely

    CWE-119TeamViewer

  7. FlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function. This vulnerability allows attackers to elevate local process privileges via o…CVE-2020-28967Flashget · 8.9% likely

    CWE-120

  8. CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)CVE-2021-34583CODESYS · CVSS 7.5 · 8.8% likely

    CWE-122CODESYS

  9. XSS in `*Text` options of the Datepicker widgetCVE-2021-41183jquery · CVSS 6.5 · 8.5% likely

    CWE-79Jquery

  10. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.…CVE-2021-35556Oracle Corporation · CVSS 5.3 · 8.4% likely

    CWE-693Oracle

  11. Adobe Acrobat Reader DC JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityCVE-2021-40731Adobe · CVSS 7.8 · 8.3% likely

    CWE-787Adobe

  12. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.CVE-2021-37762Zohocorp · 8.1% likely

    CWE-434Zoho (ManageEngine)

  13. Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-40469Microsoft · CVSS 7.2 · 7.6% likely

    Microsoft

  14. Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerabili…CVE-2021-2471Oracle Corporation · CVSS 5.9 · 7.5% likely

    Oracle

  15. Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary cod…CVE-2021-37748Grandstream · 7.4% likely

    CWE-787Grandstream

  16. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.1…CVE-2021-35565Oracle Corporation · CVSS 5.3 · 7.4% likely

    Oracle

  17. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.1…CVE-2021-35550Oracle Corporation · CVSS 5.9 · 7.4% likely

    Oracle

  18. Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters..CVE-2021-41646Janobe · 7.3% likely

    CWE-434Janobe

  19. Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\ in a scriptName JSON value to Servi…CVE-2021-40371Gridprosoftware · 7.1% likely

    CWE-22

  20. In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to remote code execution with no additional execution privile…CVE-2021-0870Google · 7.0% likely

    CWE-362Google

  21. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.…CVE-2021-35561Oracle Corporation · CVSS 5.3 · 6.9% likely

    Oracle

  22. The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated…CVE-2021-41990Strongswan · 6.9% likely

    CWE-190Strongswan

  23. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.…CVE-2021-35586Oracle Corporation · CVSS 5.3 · 6.8% likely

    Oracle

  24. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17;…CVE-2021-35578Oracle Corporation · CVSS 5.3 · 6.7% likely

    Oracle

  25. The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the wh…CVE-2021-37137The Netty project · 6.6% likely

    CWE-400Netty

  26. The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69_cmd.cgi.…CVE-2021-20122Telus · 6.5% likely

    CWE-78

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.