CISA's list that day
18 January 2022
On CISA added 13 vulnerabilities to its list of exploited vulnerabilities, in Apache Airflow, Drupal core, Apache Airflow's Experimental API and 8 other products. The US federal deadlines run from to .
Added that day
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2020-11978Command Injection | Apache Airflow | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2020-13927Authentication Bypass | Apache Airflow's Experimental API | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API | VMware vRealize Operations Manager API | Patch this weekRansomware use; Metasploit module; EPSS 0.78 | 0.78 | ||
| CVE-2021-25296OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.72 | 0.72 | ||
| CVE-2021-25297OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.57 | 0.57 | ||
| CVE-2021-25298OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.75 | 0.75 | ||
| CVE-2020-14864Business Intelligence Enterprise Edition Path Transversal | Oracle Intelligence Enterprise Edition | Patch this weekEPSS 0.97 | 0.97 | ||
| CVE-2021-21315Command Injection | Npm package System Information Library for Node.JS | Patch this weekEPSS 0.91 | 0.91 | ||
| CVE-2021-22991Buffer Overflow | F5 BIG-IP Traffic Management Microkernel | Patch this weekEPSS 0.61 | 0.61 | ||
| CVE-2021-32648Improper Authentication | October CMS October CMS | Patch this weekEPSS 0.90 | 0.90 | ||
| CVE-2021-33766Information Disclosure | Microsoft Exchange Server | Patch this weekEPSS 0.98 | 0.98 | ||
| CVE-2021-40870Unrestricted Upload of File | Aviatrix Aviatrix Controller | Patch this weekEPSS 0.93 | 0.93 | ||
| CVE-2020-13671Un-restricted Upload of File | Drupal Drupal core | Patch soon | 0.35 |
Our record of CISA's changes begins on 24 January 2025. For earlier days this page lists the entries CISA dates to this day; changes CISA made that day are not known to us.