Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

15 records in Mysql Connectors · all components

TI-2021-02645 CVE-2021-3711 · GHSA-5ww6-px42-wc85

SM2 Decryption Buffer Overflow

Priority CRITICAL 91

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87816 Published 2021-08-24 Partial fix · 111.16.0 CWE-120
TI-2020-01888 CVE-2020-1967 · GHSA-jq65-29v4-4x35

Segmentation fault in SSL_check_chain

Priority HIGH 71

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert"…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53336 Published 2020-04-21 Fixed in 111.9.0 CWE-476
TI-2021-02413 CVE-2021-3449 · GHSA-83mx-573x-5rw9

NULL pointer deref in signature_algorithms processing

Priority HIGH 68

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.63542 Published 2021-03-25 Fixed in 111.15.0 CWE-476
TI-2021-02646 CVE-2021-3712 · GHSA-q9wj-f4qw-6vfj

Read buffer overruns processing ASN.1 strings

Priority MEDIUM 63

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.48084 Published 2021-08-24 Partial fix · 111.16.0 CWE-125
TI-2021-02414 CVE-2021-3450 · GHSA-8hfj-xrj2-pm22

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Priority MEDIUM 58

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.18339 Published 2021-03-25 Fixed in 111.15.0 CWE-295
TI-2022-06195 CVE-2022-21824 · GHSA-39wv-qjgj-4jxg

Prototype pollution in NodeJS Node

Priority MEDIUM 55

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21514 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-471
TI-2021-20131 CVE-2021-44531 · GHSA-5qpf-4xwh-5775

Improper certificate validation in NodeJS Node

Priority MEDIUM 43

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.08373 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295
TI-2021-20133 CVE-2021-44533

Improper certificate validation in NodeJS Node

Priority MEDIUM 42

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.09358 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295
TI-2019-01993 CVE-2019-2435 · GHSA-v5rq-w2xm-7g5f

Improper access control in Oracle MySQL Connectors

Priority MEDIUM 42

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python).

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.02527 Published 2019-01-16 Fixed in 8.0.19 CWE-284
TI-2021-20132 CVE-2021-44532 · GHSA-jg6g-8j59-vr29

Improper certificate validation in NodeJS Node

Priority LOW 37

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.10364 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-296
TI-2021-02132 CVE-2021-2471 · GHSA-w6f2-8wx4-47r5

Incorrect authorization in Oracle MySQL Connectors

Priority LOW 37

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.07493 Published 2021-10-20 Partial fix · 8.0.27 CWE-863
TI-2017-02781 CVE-2017-3586 · GHSA-pwh7-92h3-mqr6

Information disclosure in Oracle MySQL Connectors

Priority LOW 32

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).

CVSS 3.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.01713 Published 2017-04-24 Partial fix · 5.1.42 CWE-200
TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

Priority LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Open these records in search →