Oracle

Records14201All Threatist records

Exploited (KEV)82In CISA KEV

CVSS critical1606CVSS 9.0–10.0

CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV

TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CRITICAL 100KEV 2026-08-24 TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability CRITICAL 100KEV 2026-07-15 TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records

Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

43 records in Bi Publisher · all components

TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502

TI-2021-04446 CVE-2021-21346 · GHSA-4hrm-m67v-5cxr

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76367 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-02069 CVE-2021-2400 · GHSA-xv58-2569-gmpq

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

HIGH 80

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83298 Published 2021-07-20 No fix listed

TI-2021-02070 CVE-2021-2401 · GHSA-xchm-27qm-h7w6

XML external entity injection in Oracle BI Publisher

HIGH 71

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.8482 Published 2021-07-20 No fix listed CWE-611

TI-2019-08480 CVE-2019-11358 · GHSA-6c3j-c64m-qhgq

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles…

HIGH 69

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.8682 Published 2019-04-19 Partial fix · 3.4.0, 4.3.4 +3 CWE-1321

TI-2021-02065 CVE-2021-2396 · GHSA-5pfm-pfmp-hv33

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

HIGH 66

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.35713 Published 2021-07-20 No fix listed

TI-2021-02060 CVE-2021-2391 · GHSA-wr3q-4xj2-4v9f

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

HIGH 65

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.34677 Published 2021-07-20 No fix listed

TI-2024-13874 CVE-2024-21082 · GHSA-c8fq-23wj-f2cc

XML external entity injection in Oracle BI Publisher

MEDIUM 50

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00807 Published 2024-04-16 No fix listed CWE-611

TI-2026-42874 CVE-2026-60173 · GHSA-38jr-2hm2-5prc

Improper access control in Oracle BI Publisher

MEDIUM 49

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-284

TI-2021-02061 CVE-2021-2392 · GHSA-wvph-ghx4-mpj2

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

MEDIUM 46

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03119 Published 2021-07-20 No fix listed

TI-2019-02308 CVE-2019-2767 · GHSA-9m8g-jq9x-h3f8

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion…

MEDIUM 46

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).

CVSS 3.0HIGH 7.2 Network No auth No interaction EPSS 0.05238 Published 2019-07-23 No fix listed

TI-2026-49752 CVE-2026-71059 · GHSA-xp2f-8xcv-vhw4

Improper access control in Oracle BI Publisher

MEDIUM 43

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-18 No fix listed CWE-284

TI-2026-43382 CVE-2026-60719 · GHSA-66mf-5fqj-p3p5

Improper input validation in Oracle BI Publisher

MEDIUM 43

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00387 Published 2026-07-21 No fix listed CWE-20

TI-2022-05736 CVE-2022-21346 · GHSA-3p64-r56c-8fcp

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

MEDIUM 43

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02169 Published 2022-01-19 No fix listed

TI-2019-02309 CVE-2019-2768 · GHSA-54j5-p37g-5f4q

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion…

MEDIUM 42

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01711 Published 2019-07-23 No fix listed

TI-2024-14030 CVE-2024-21254 · GHSA-mw6x-r32h-w49v

Missing authorization in Oracle BI Publisher

MEDIUM 41

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2024-10-15 No fix listed CWE-862

TI-2023-08224 CVE-2023-21846 · GHSA-v87v-fqxx-3fpf

Improper access control in Oracle BI Publisher

MEDIUM 41

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00648 Published 2023-01-17 No fix listed CWE-284

TI-2023-08210 CVE-2023-21832 · GHSA-v5c9-q3g2-rw6f

Improper access control in Oracle BI Publisher

MEDIUM 41

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00648 Published 2023-01-17 No fix listed CWE-284

TI-2026-49751 CVE-2026-71058 · GHSA-8pxm-9jh4-v7ph

Improper access control in Oracle BI Publisher

MEDIUM 40

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-18 No fix listed CWE-284

TI-2020-11420 CVE-2020-14571 · GHSA-6mjj-xrpg-96vg

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component…

MEDIUM 40

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Mobile Service).

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01218 Published 2020-07-15 No fix listed

TI-2026-43949 CVE-2026-61305 · GHSA-9rmm-w62g-8m4r

Improper access control in Oracle BI Publisher

LOW 38

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00387 Published 2026-08-18 No fix listed CWE-284

TI-2020-11434 CVE-2020-14585 · GHSA-x6vc-43v3-pjqr

Cross-site scripting in Oracle BI Publisher

LOW 38

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Mobile Service).

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.01384 Published 2020-07-15 No fix listed CWE-79

TI-2020-11433 CVE-2020-14584 · GHSA-8g54-6pcx-c3vq

Cross-site scripting in Oracle BI Publisher

LOW 38

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.01384 Published 2020-07-15 No fix listed CWE-79

TI-2019-02312 CVE-2019-2771 · GHSA-rpmx-h4jc-7v2q

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion…

LOW 38

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).

CVSS 3.0HIGH 8.2 Network Low privileges User interaction EPSS 0.00959 Published 2019-07-23 No fix listed

TI-2026-49750 CVE-2026-71057 · GHSA-6c9v-5rmq-634f

Improper access control in Oracle BI Publisher

LOW 37

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00376 Published 2026-08-18 No fix listed CWE-284

Open these records in search →

Critical	1606
High	4615
Medium	6805
Low	1173
No CVSS	2