Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

61 records in Essbase · all components

TI-2021-02645 CVE-2021-3711 · GHSA-5ww6-px42-wc85

SM2 Decryption Buffer Overflow

Priority CRITICAL 91

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87816 Published 2021-08-24 Partial fix · 111.16.0 CWE-120
TI-2021-05762 CVE-2021-22901 · GHSA-vjwf-ghhc-2p8q

Use after free in https://github.com/curl/curl

Priority HIGH 79

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.63531 Published 2021-06-11 Fixed CWE-416
TI-2020-06702 CVE-2020-8285 · GHSA-4p2h-jggv-23jg

Uncontrolled recursion in https://github.com/curl/curl

Priority HIGH 72

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0977 Published 2020-12-14 Partial fix CWE-674
TI-2021-02413 CVE-2021-3449 · GHSA-83mx-573x-5rw9

NULL pointer deref in signature_algorithms processing

Priority HIGH 68

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.63542 Published 2021-03-25 Fixed in 111.15.0 CWE-476
TI-2021-05758 CVE-2021-22897 · GHSA-frcg-47mh-pj2g

Exposure of resource to wrong sphere in https://github.com/curl/curl

Priority MEDIUM 63

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.04265 Published 2021-06-11 Will not fix CWE-840
TI-2021-05737 CVE-2021-22876 · GHSA-jjr6-2g8j-hmwr

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 63

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05301 Published 2021-04-01 Partial fix CWE-359
TI-2021-02646 CVE-2021-3712 · GHSA-q9wj-f4qw-6vfj

Read buffer overruns processing ASN.1 strings

Priority MEDIUM 63

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.48084 Published 2021-08-24 Partial fix · 111.16.0 CWE-125
TI-2021-05751 CVE-2021-22890 · GHSA-5cwr-528x-3vwc

Authentication bypass by spoofing in https://github.com/curl/curl

Priority MEDIUM 53

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.03057 Published 2021-04-01 Partial fix CWE-300
TI-2020-06701 CVE-2020-8284 · GHSA-69rc-qfx4-h683

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 51

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherw…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03898 Published 2020-12-14 Partial fix CWE-200
TI-2026-49384 CVE-2026-70689 · GHSA-998x-p9h7-3r93

Improper access control in Oracle Essbase

Priority MEDIUM 49

Vulnerability in Oracle Essbase (component: Infrastructure).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-08-18 No fix listed CWE-284
TI-2019-09249 CVE-2019-12402 · GHSA-53x6-4x5p-rrvv

Infinite loop in Apache Commons Compress

Priority MEDIUM 49

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.16157 Published 2019-08-29 Partial fix · 1.19 CWE-835
TI-2021-05759 CVE-2021-22898 · GHSA-7w8r-q58w-5wcr

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 48

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.04507 Published 2021-06-11 Partial fix CWE-200
TI-2020-06703 CVE-2020-8286 · GHSA-xh5x-q49r-r9w4

Improper certificate validation in https://github.com/curl/curl

Priority MEDIUM 46

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04631 Published 2020-12-14 Partial fix CWE-295
TI-2020-06277 CVE-2020-7760 · GHSA-4gw3-8f77-f72c

Regular expression denial of service (ReDoS) in codemirror

Priority MEDIUM 41

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05304 Published 2020-10-30 Partial fix · 5.58.2 CWE-400
TI-2026-49383 CVE-2026-70688 · GHSA-7fxm-g4fj-4h9j

Improper access control in Oracle Essbase

Priority MEDIUM 40

Vulnerability in Oracle Essbase (component: Calculator).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-18 No fix listed CWE-284
Load more
Open these records in search →