Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

197 records in Graalvm · all components

TI-2020-06291 CVE-2020-7774 · GHSA-c4w7-xm78-47vh

Prototype pollution in y18n

Priority HIGH 79

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69589 Published 2020-11-17 Partial fix · 5.0.5, 3.2.2 +1 CWE-1321
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-05744 CVE-2021-22883 · GHSA-mjgw-69fr-p4h2

Uncontrolled resource consumption in NodeJS Node

Priority HIGH 72

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77385 Published 2021-03-03 Partial fix · 10.24.0, 12.21.0 +2 CWE-400
TI-2021-06204 CVE-2021-23840 · GHSA-qgm6-9472-pwq7

Integer overflow in CipherUpdate

Priority HIGH 70

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.50732 Published 2021-02-16 Partial fix · 111.14.0 CWE-190
TI-2021-05792 CVE-2021-22931 · GHSA-7r9p-c88x-w357

Improper input validation in NodeJS Node

Priority HIGH 68

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21952 Published 2021-08-16 Partial fix · 12.22.5, 14.17.5 +1 CWE-170
TI-2021-02413 CVE-2021-3449 · GHSA-83mx-573x-5rw9

NULL pointer deref in signature_algorithms processing

Priority HIGH 68

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.63542 Published 2021-03-25 Fixed in 111.15.0 CWE-476
TI-2020-06694 CVE-2020-8277 · GHSA-m5pg-8h68-j225

Uncontrolled resource consumption in NodeJS Node

Priority HIGH 65

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a D…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.54164 Published 2020-11-19 Fixed in 12.19.1, 14.15.1 +1 CWE-400
TI-2021-14283 CVE-2021-35556 · GHSA-rx4c-whwx-3x45

Protection mechanism failure in Oracle Java SE JDK and JRE

Priority MEDIUM 63

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.08395 Published 2021-10-20 Partial fix CWE-693
TI-2019-11705 CVE-2019-15606 · GHSA-3qv8-368w-r69p

Improper input validation in NodeJS Node

Priority MEDIUM 61

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20041 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-20
TI-2021-02414 CVE-2021-3450 · GHSA-8hfj-xrj2-pm22

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Priority MEDIUM 58

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.18339 Published 2021-03-25 Fixed in 111.15.0 CWE-295
Load more
Open these records in search →