Flaws added in December 2021
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in December 2021. For the newest, see Exploited flaws.
In December 2021, CISA added 20 flaws to its list of vulnerabilities being used in attacks, 4 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Zoho (3), Apache (3) and Red Hat (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in December 2021, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-43890† Used in ransomwareAt home |
Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. | At home |
CVE-2021-4102At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
13 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-44515At work |
Zoho Desktop Central. Attackers can run their own code on Zoho Desktop Central. | At work |
CVE-2021-44228† Used in ransomwareAt work |
Apache Log4j2. Attackers can run their own code on Apache Log4j2. | At work |
CVE-2021-44168At work |
Fortinet FortiOS. Attackers can read files on Fortinet FortiOS that should be out of reach. | At work |
CVE-2021-35394At home |
Realtek Jungle Software Development Kit (SDK). Attackers can run their own code on Realtek Jungle Software Development Kit (SDK) from anywhere, without logging in. | At home |
CVE-2020-8816At work |
Pi-hole AdminLTE. Attackers can run their own code on Pi-hole AdminLTE. | At work |
CVE-2020-17463At work |
Fuel CMS. Attackers can read or change the database behind Fuel CMS. | At work |
CVE-2019-7238At work |
Sonatype Nexus Repository Manager. Attackers can run their own code on Sonatype Nexus Repository Manager. | At work |
CVE-2019-13272At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2019-10758At work |
MongoDB mongo-express. Attackers can run their own code on MongoDB mongo-express. | At work |
CVE-2019-0193At work |
Apache Solr. Attackers can run their own code on Apache Solr. | At work |
CVE-2017-17562At work |
Embedthis GoAhead. Attackers can run their own code on Embedthis GoAhead. | At work |
CVE-2017-12149† Used in ransomwareAt work |
Red Hat JBoss Application Server. Attackers can run their own code on Red Hat JBoss Application Server. | At work |
CVE-2010-1871At work |
Red Hat JBoss Seam 2. Attackers can run their own code on Red Hat JBoss Seam 2. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-44077At work |
Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. Attackers can run their own code on Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus from anywhere, without logging in. | At work |
CVE-2021-40438† Used in ransomwareAt work |
Apache. Attackers can make Apache send requests into the network behind it. | At work |
CVE-2021-37415At work |
Zoho ManageEngine ServiceDesk Plus (SDP). Attackers can get into Zoho ManageEngine ServiceDesk Plus (SDP) without a valid password. | At work |
CVE-2020-11261At home |
Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables. Attackers can corrupt memory in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, which they use to take it over. | At home |
CVE-2018-14847At work |
MikroTik RouterOS. Attackers can read files on MikroTik RouterOS that should be out of reach from anywhere, without logging in. | At work |
Companies
The flaws were in 15 companies’ products; the most were in Apache’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Apache | 3 | 2 |
| Zoho | 3 | – |
| Red Hat | 2 | 1 |
| Embedthis | 1 | – |
| Fortinet | 1 | – |
| Fuel CMS | 1 | – |
| 1 | – | |
| Linux | 1 | – |
| Microsoft | 1 | 1 |
| MikroTik | 1 | – |
| MongoDB | 1 | – |
| Pi-hole | 1 | – |
| Qualcomm | 1 | – |
| Realtek | 1 | – |
| Sonatype | 1 | – |
Other months
Every month since CISA started the list; December 2021 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.