Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

14201 records

TI-2026-34425 CVE-2026-46817 · GHSA-pv4m-gf99-c5jr

Improper privilege management in Oracle Payments

Priority CRITICAL 100KEV

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12313 Published 2026-05-28 No fix listed CWE-269
TI-2026-17661 CVE-2026-21962 · GHSA-4wp9-cf5h-v2g5

Improper access control in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in

Priority CRITICAL 100KEV

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.73192 Published 2026-01-20 No fix listed CWE-284
TI-2025-38252 CVE-2025-61882 · GHSA-hgff-wp2m-jgfw

Improper authentication in Oracle Concurrent Processing

Priority CRITICAL 100KEV

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99728 Published 2025-10-05 No fix listed CWE-287
TI-2025-38151 CVE-2025-61757 · GHSA-v5gw-cq42-m6w2

Missing authentication in Oracle Identity Manager

Priority CRITICAL 100KEV

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.88647 Published 2025-10-21 No fix listed CWE-306
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2022-07140 CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

Priority CRITICAL 100KEV

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99938 Published 2022-04-01 Fixed in 3.2.3, 3.1.7 CWE-94
TI-2022-07125 CVE-2022-22947 · GHSA-3gx9-37ww-9qw6

Code injection in Spring Cloud Gateway

Priority CRITICAL 100KEV

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.98253 Published 2022-03-03 Fixed in 3.0.7, 3.1.1 CWE-94
TI-2021-14313 CVE-2021-35587 · GHSA-x3jv-936g-xqj4

Missing authentication in Oracle Access Manager

Priority CRITICAL 100KEV

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96284 Published 2022-01-19 No fix listed CWE-306
TI-2020-13278 CVE-2020-17530 · GHSA-jc35-q369-45pv

Expression language injection in Apache Struts

Priority CRITICAL 100KEV

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96251 Published 2020-12-11 Fixed in 2.5.26 CWE-917
TI-2020-11706 CVE-2020-14871 · GHSA-7pcp-8fjh-246q

Out-of-bounds write in Oracle Solaris Operating System

Priority CRITICAL 100KEV

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.80157 Published 2020-10-21 No fix listed CWE-787
TI-2020-02258 CVE-2020-2555 · GHSA-gm93-pfh3-mrf3

Deserialization of untrusted data in Oracle WebCenter Portal

Priority CRITICAL 100KEV

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97116 Published 2020-01-15 No fix listed CWE-502
TI-2020-01862 CVE-2020-1938 · GHSA-c9hw-wf7x-jp9j

Improper privilege management in Apache Tomcat

Priority CRITICAL 100KEV

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9927 Published 2020-02-24 Partial fix · 9.0.31, 8.5.51 +1 CWE-269
TI-2020-01431 CVE-2020-1472 · GHSA-gc5h-xf3g-h5x4

Netlogon Elevation of Privilege Vulnerability

Priority CRITICAL 100KEV

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99389 Published 2020-08-17 Partial fix · publication
TI-2019-02266 CVE-2019-2725 · GHSA-m437-3crh-7475

Injection in Oracle Tape Library ACSLS

Priority CRITICAL 100KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99977 Published 2019-04-26 No fix listed CWE-74
TI-2018-01947 CVE-2018-2628 · GHSA-882j-m7wv-38p6

Deserialization of untrusted data in Oracle WebLogic Server

Priority CRITICAL 100KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99958 Published 2018-04-19 No fix listed CWE-502
Load more
Open these records in search →