Oracle

Records14201All Threatist records

Exploited (KEV)82In CISA KEV

CVSS critical1606CVSS 9.0–10.0

CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV

TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CRITICAL 100KEV 2026-08-24 TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability CRITICAL 100KEV 2026-07-15 TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records

Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

49 records in Identity Manager Connector · all components

TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502

TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89

TI-2022-07425 CVE-2022-23302 · GHSA-w9p3-5cr8-m3jj

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

HIGH 76

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63841 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-502

TI-2022-07429 CVE-2022-23307 · GHSA-f7vh-qwp3-x37m

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

HIGH 73

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54411 Published 2022-01-18 Partial fix CWE-502

TI-2021-20437 CVE-2021-45105 · GHSA-p6xc-xr62-6r2g

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

HIGH 72

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.99999 Published 2021-12-18 Partial fix · 2.17.0, 2.12.3 +5 CWE-20

TI-2020-15088 CVE-2020-24616 · GHSA-h3cw-g4mq-c5x2

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between…

MEDIUM 54

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07614 Published 2020-08-25 Partial fix · 2.9.10.6 CWE-502

TI-2020-15186 CVE-2020-24750 · GHSA-qjw2-hr98-qgfh

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between…

MEDIUM 53

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07327 Published 2020-09-17 Partial fix · 2.6.7.5, 2.9.10.6 CWE-502

TI-2018-11237 CVE-2018-15756 · GHSA-ffvq-7w96-97p7

DoS Attack via Range Requests

MEDIUM 50

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08797 Published 2018-10-18 Partial fix · 5.1.1.RELEASE, 5.0.10.RELEASE +1

TI-2026-77541 CVE-2026-91491 · GHSA-c2vp-mgg4-vg5v

Authentication flaw in Oracle Identity Manager Connector LDAP Gateway

MEDIUM 49

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00354 Published 2026-10-20 No fix listed CWE-287

TI-2026-43200 CVE-2026-60535 · GHSA-qv97-5c86-j6f9

Missing authentication in Oracle Identity Manager Connector

MEDIUM 49

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-306

TI-2026-43197 CVE-2026-60532 · GHSA-fq9j-rrfr-x6m9

Improper privilege management in Oracle Identity Manager Connector

MEDIUM 49

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-269

TI-2026-77540 CVE-2026-91490 · GHSA-w5j9-8hf8-rh6m

Missing authentication in Oracle Identity Manager Connector LDAP Gateway

MEDIUM 47

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00396 Published 2026-10-20 No fix listed CWE-287

TI-2026-26576 CVE-2026-34287 · GHSA-g233-f2vv-qw6j

Improper access control in Oracle Identity Manager Connector

MEDIUM 47

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00346 Published 2026-04-21 No fix listed CWE-284

TI-2026-26575 CVE-2026-34286 · GHSA-jg6g-fp64-wgx2

Missing authentication in Oracle Identity Manager Connector

MEDIUM 47

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00413 Published 2026-04-21 No fix listed CWE-306

TI-2026-26574 CVE-2026-34285 · GHSA-w2j6-p7c6-6cpj

Missing authentication in Oracle Identity Manager Connector

MEDIUM 47

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00413 Published 2026-04-21 No fix listed CWE-306

TI-2019-00195 CVE-2019-0222 · GHSA-jpv3-g4cc-6vfx

Code injection in Apache ActiveMQ

MEDIUM 47

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12033 Published 2019-03-28 Partial fix · 5.15.9 CWE-94

TI-2026-77272 CVE-2026-91212 · GHSA-7gwc-x8h4-7vm7

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00307 Published 2026-10-20 No fix listed CWE-284

TI-2026-57264 CVE-2026-83023 · GHSA-q9fv-vq98-p2m9

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00414 Published 2026-09-15 No fix listed CWE-284

TI-2026-43639 CVE-2026-60995 · GHSA-vv8p-hq33-5fh6

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-18 No fix listed CWE-284

TI-2026-43634 CVE-2026-60990 · GHSA-2r6m-9444-m58g

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-18 No fix listed CWE-284

TI-2026-43201 CVE-2026-60536 · GHSA-3j74-wcrh-q2qv

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00414 Published 2026-07-21 No fix listed CWE-284

TI-2026-43196 CVE-2026-60531 · GHSA-9pph-6vxw-m33f

Missing authentication in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00432 Published 2026-07-21 No fix listed CWE-306

TI-2026-34403 CVE-2026-46794 · GHSA-fv2r-585v-pc56

Improper privilege management in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00432 Published 2026-06-16 No fix listed CWE-269

TI-2026-34402 CVE-2026-46793 · GHSA-fmxw-fqw2-5v57

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-16 No fix listed CWE-284

TI-2026-34401 CVE-2026-46792 · GHSA-9mjj-vx48-7j24

Improper access control in Oracle Identity Manager Connector

MEDIUM 43

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-16 No fix listed CWE-284

Open these records in search →

Critical	1606
High	4615
Medium	6805
Low	1173
No CVSS	2