Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

21 records in Enterprise Repository · all components

TI-2020-09657 CVE-2020-11998 · GHSA-wqfh-9m4g-7x6x

Code injection in Apache ActiveMQ

Priority HIGH 73

A regression has been introduced in the commit preventing JMX re-bind.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48885 Published 2020-09-10 Fixed in 5.15.13 CWE-94
TI-2018-05790 CVE-2018-8013 · GHSA-25gw-4pcc-45cf

Deserialization of untrusted data in Apache Batik

Priority MEDIUM 60

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.18591 Published 2018-05-24 Partial fix · 1.10 CWE-502
TI-2020-09647 CVE-2020-11987 · GHSA-2h63-qp69-fwvw

Improper input validation in Apache Batik

Priority MEDIUM 57

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.13635 Published 2021-02-24 Partial fix · 1.14 CWE-20
TI-2018-15967 CVE-2018-1000613 · GHSA-4446-656p-f54g

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to…

Priority MEDIUM 56

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vuln…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04767 Published 2018-07-09 Partial fix · 1.60 CWE-470
TI-2020-09639 CVE-2020-11979 · GHSA-f62v-xpxf-3v68

Injection in Apache Ant

Priority MEDIUM 49

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07757 Published 2020-10-01 Partial fix · 1.10.9 CWE-379
TI-2019-00195 CVE-2019-0222 · GHSA-jpv3-g4cc-6vfx

Code injection in Apache ActiveMQ

Priority MEDIUM 47

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12033 Published 2019-03-28 Partial fix · 5.15.9 CWE-94
TI-2019-13109 CVE-2019-17566 · GHSA-cmx4-p4v5-hmr5

Server-side request forgery in Apache Batik

Priority MEDIUM 46

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10867 Published 2020-11-12 Partial fix · 1.13 CWE-918
TI-2019-00165 CVE-2019-0188 · GHSA-h896-mx9x-g32g

XML external entity injection in Apache Camel

Priority MEDIUM 45

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09782 Published 2019-05-28 Partial fix · 2.24.0 CWE-611
TI-2018-01163 CVE-2018-1258 · GHSA-cxrj-66c5-9fmh

Incorrect authorization in Pivotal Spring Framework

Priority MEDIUM 43

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02461 Published 2018-05-11 Fixed in 5.0.6.RELEASE CWE-863
TI-2018-08432 CVE-2018-11775 · GHSA-m9w8-v359-9ffr

Improper certificate validation in Apache ActiveMQ

Priority MEDIUM 42

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ serv…

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.06959 Published 2018-09-10 Partial fix · 5.15.6 CWE-295
TI-2018-15829 CVE-2018-1000180 · GHSA-xqj7-j8j5-f2xr

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the…

Priority LOW 39

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have l…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0342 Published 2018-06-05 Partial fix · 1.60 CWE-327
TI-2020-01865 CVE-2020-1941 · GHSA-cc94-3v9c-7rm8

Cross-site scripting in Apache ActiveMQ

Priority LOW 37

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0715 Published 2020-05-14 Partial fix · 5.15.12 CWE-79
TI-2020-01869 CVE-2020-1945 · GHSA-4p6w-m9wc-c9c9

Exposure of resource to wrong sphere in Apache Ant

Priority LOW 32

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.01769 Published 2020-05-14 Partial fix · 1.9.15, 1.10.8 CWE-668
TI-2021-14728 CVE-2021-36374 · GHSA-5v34-g2px-j4fw

Apache Ant ZIP, and ZIP based, archive denial of service vulerability

Priority LOW 30

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.02642 Published 2021-07-14 Partial fix · 1.9.16, 1.10.11 CWE-130
TI-2021-14727 CVE-2021-36373 · GHSA-q5r4-cfpx-h6fh

Apache Ant TAR archive denial of service vulnerability

Priority LOW 30

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.02532 Published 2021-07-14 Partial fix · Apache Ant, 1.9.16 +1 CWE-130
TI-2019-09260 CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g

XML external entity injection in Apache POI

Priority LOW 27

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from intern…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00998 Published 2019-10-23 Partial fix · 4.1.1 CWE-611
Open these records in search →