Oracle

Records14201All Threatist records

Exploited (KEV)82In CISA KEV

CVSS critical1606CVSS 9.0–10.0

CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV

TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CRITICAL 100KEV 2026-08-24 TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability CRITICAL 100KEV 2026-07-15 TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records

Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

75 records in Communications Unified Inventory Management · all components

TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94

TI-2021-16530 CVE-2021-39144 · GHSA-j9h8-phrw-h4fh

XStream is vulnerable to a Remote Command Execution attack

CRITICAL 96KEV

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.98124 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-04451 CVE-2021-21351 · GHSA-hrcp-8f3q-4w2c

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.82136 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04446 CVE-2021-21346 · GHSA-4hrm-m67v-5cxr

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76367 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04444 CVE-2021-21344 · GHSA-59jw-jqf4-3wq3

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7598 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2019-07494 CVE-2019-10173 · GHSA-hf23-9pf7-388p

Code injection in xstream

CRITICAL 86

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95036 Published 2019-07-23 Fixed in 1.4.11 CWE-94

TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89

TI-2021-04445 CVE-2021-21345 · GHSA-hwpc-8xqv-jvj4

XStream is vulnerable to a Remote Command Execution attack

HIGH 81

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.72324 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-10213 CVE-2021-29505 · GHSA-7chv-rrw6-w6fc

XStream is vulnerable to a Remote Command Execution attack

HIGH 79

XStream is software for serializing Java objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77232 Published 2021-05-28 Partial fix · 1.4.17 CWE-502

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2022-07425 CVE-2022-23302 · GHSA-w9p3-5cr8-m3jj

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

HIGH 76

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63841 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-502

TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2022-07429 CVE-2022-23307 · GHSA-f7vh-qwp3-x37m

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

HIGH 73

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54411 Published 2022-01-18 Partial fix CWE-502

TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-02983 CVE-2021-4104 · GHSA-fp5r-v3w9-4333

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

HIGH 73

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.80599 Published 2021-12-14 Partial fix CWE-502

TI-2021-20437 CVE-2021-45105 · GHSA-p6xc-xr62-6r2g

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

HIGH 72

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.99999 Published 2021-12-18 Partial fix · 2.17.0, 2.12.3 +5 CWE-20

TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2019-08480 CVE-2019-11358 · GHSA-6c3j-c64m-qhgq

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles…

HIGH 69

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.8682 Published 2019-04-19 Partial fix · 3.4.0, 4.3.4 +3 CWE-1321

TI-2021-04450 CVE-2021-21350 · GHSA-43gc-mjxg-gvrq

XStream is vulnerable to an Arbitrary Code Execution attack

HIGH 65

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15234 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04447 CVE-2021-21347 · GHSA-qpfq-ph7r-qv6f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 64

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14301 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-16528 CVE-2021-39141 · GHSA-g5w6-mrj7-75h2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 61

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.16118 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2019-07411 CVE-2019-10086 · GHSA-6phf-73q6-gh87

Deserialization of untrusted data in Apache Commons Beanutils

MEDIUM 61

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.29082 Published 2019-08-20 Partial fix · 1.9.4 CWE-502

TI-2021-16532 CVE-2021-39146 · GHSA-p8pq-r894-fm8f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 60

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.143 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2020-18499 CVE-2020-36179 · GHSA-9gph-22xh-8x98

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.17065 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2021-16538 CVE-2021-39152 · GHSA-xw4p-crpj-vjx2

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

MEDIUM 56

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.11377 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

Open these records in search →