Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

16 records in Hospitality Cruise Shipboard Property Management System · all components

TI-2022-12240 CVE-2022-29885 · GHSA-r84p-88g2-2vx2

EncryptInterceptor does not provide complete protection on insecure networks

Priority HIGH 77

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.73474 Published 2022-05-12 Partial fix · 10.1.0-M15, 10.0.21 +2 CWE-400
TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444
TI-2021-11031 CVE-2021-30640 · GHSA-36qh-35cm-5w2w

Auth weakness in JNDIRealm

Priority MEDIUM 47

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.09886 Published 2021-07-12 Partial fix · 10.0.5, 9.0.45 +1 CWE-116
TI-2021-18769 CVE-2021-42340 · GHSA-wph7-x527-w3h5

DoS via memory leak with WebSocket connections

Priority MEDIUM 46

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11796 Published 2021-10-14 Partial fix · 10.1.0-M6, 10.0.12 +2 CWE-772
TI-2021-05104 CVE-2021-22112 · GHSA-gq28-h5vg-8prx

Improper privilege management in Spring Security

Priority MEDIUM 44

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03286 Published 2021-02-23 Fixed in 5.4.4, 5.3.8 +1 CWE-269
TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

Priority LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Open these records in search →