Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

44 records in Commerce Platform · all components

TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2020-02258 CVE-2020-2555 · GHSA-gm93-pfh3-mrf3

Deserialization of untrusted data in Oracle WebCenter Portal

Priority CRITICAL 100KEV

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97116 Published 2020-01-15 No fix listed CWE-502
TI-2020-15666 CVE-2020-25649 · GHSA-288c-cq4h-88gq

XML external entity injection in jackson-databind

Priority MEDIUM 56

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.17714 Published 2020-12-03 Partial fix · 2.6.7.4, 2.9.10.7 +1 CWE-611
TI-2020-18508 CVE-2020-36188 · GHSA-f9xh-2qgp-cq57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08787 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
TI-2020-18187 CVE-2020-35728 · GHSA-5r5r-6hpj-8gg9

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 51

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.12504 Published 2020-12-27 Partial fix · 2.9.10.8 CWE-502
TI-2020-18509 CVE-2020-36189 · GHSA-vfqx-33qm-g869

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03987 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
TI-2026-49647 CVE-2026-70954 · GHSA-86j4-hv26-f6v3

Missing authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-08-18 No fix listed CWE-306
TI-2026-49646 CVE-2026-70953 · GHSA-r96c-fqgg-hpcp

Missing authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-08-18 No fix listed CWE-306
TI-2026-43775 CVE-2026-61131 · GHSA-vqg7-q7mc-xx67

Improper access control in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-284
TI-2026-43773 CVE-2026-61129 · GHSA-c35r-wmmq-534h

Improper authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-287
TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
TI-2026-43774 CVE-2026-61130 · GHSA-6vm2-wvf9-24gh

Improper access control in Oracle Commerce Platform

Priority MEDIUM 46

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00494 Published 2026-07-21 No fix listed CWE-284
TI-2026-43777 CVE-2026-61133 · GHSA-vrp3-w3m3-9r2x

Information disclosure in Oracle Commerce Platform

Priority LOW 39

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00437 Published 2026-07-21 No fix listed CWE-200
Load more
Open these records in search →