Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

50 records in Communications Policy Management · all components

TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2020-13278 CVE-2020-17530 · GHSA-jc35-q369-45pv

Expression language injection in Apache Struts

Priority CRITICAL 100KEV

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96251 Published 2020-12-11 Fixed in 2.5.26 CWE-917
TI-2018-08433 CVE-2018-11776 · GHSA-cr6j-3jp9-rw65

Improper input validation in Apache Struts

Priority CRITICAL 94KEV

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99996 Published 2018-08-22 Fixed in 2.3.35, 2.5.17 CWE-20
TI-2020-16038 CVE-2020-26217 · GHSA-mw36-7c6c-q4q2

Remote Code Execution in XStream

Priority CRITICAL 87

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84968 Published 2020-11-16 Partial fix · 1.4.14, 1.4.14-java7 CWE-78
TI-2019-00203 CVE-2019-0230 · GHSA-wp4h-pvgw-5727

Prototype pollution in Apache Struts

Priority CRITICAL 86

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96946 Published 2020-09-14 Partial fix · 2.5.22 CWE-1321
TI-2020-04444 CVE-2020-5398 · GHSA-8wx2-9q48-vm9r

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

Priority HIGH 77

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Dispo…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.88322 Published 2020-01-16 Partial fix · v5.0.16.RELEASE, v5.1.13.RELEASE +4 CWE-79
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-06141 CVE-2021-23450 · GHSA-m8gw-hjpr-rjv7

Prototype pollution in dojo

Priority HIGH 72

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.30367 Published 2021-12-17 No fix listed CWE-1321
TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-19417 CVE-2021-43527 · GHSA-7hfm-39v6-v3p5

Out-of-bounds write in Mozilla NSS

Priority MEDIUM 59

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17563 Published 2021-12-08 Fixed in 3.73, 3.68.1 CWE-787
TI-2015-02479 CVE-2015-2808 · GHSA-jcj6-c96p-jcmm

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly…

Priority MEDIUM 56

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recover…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.73851 Published 2015-04-01 Partial fix CWE-327
TI-2020-18508 CVE-2020-36188 · GHSA-f9xh-2qgp-cq57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08787 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
Load more
Open these records in search →