Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

348 records in Mysql Server · all components

TI-2021-02645 CVE-2021-3711 · GHSA-5ww6-px42-wc85

SM2 Decryption Buffer Overflow

Priority CRITICAL 91

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87816 Published 2021-08-24 Partial fix · 111.16.0 CWE-120
TI-2022-01176 CVE-2022-1292 · GHSA-qjmp-vmxc-7p8r

The c_rehash script allows command injection

Priority CRITICAL 90

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82612 Published 2022-05-03 Partial fix CWE-78
TI-2021-05762 CVE-2021-22901 · GHSA-vjwf-ghhc-2p8q

Use after free in https://github.com/curl/curl

Priority HIGH 79

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.63531 Published 2021-06-11 Fixed CWE-416
TI-2021-05807 CVE-2021-22946 · GHSA-3cmq-42w4-c529

Cleartext transmission of sensitive information in https://github.com/curl/curl

Priority HIGH 72

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLU…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04539 Published 2021-09-29 Partial fix CWE-325
TI-2021-06204 CVE-2021-23840 · GHSA-qgm6-9472-pwq7

Integer overflow in CipherUpdate

Priority HIGH 70

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.50732 Published 2021-02-16 Partial fix · 111.14.0 CWE-190
TI-2021-02413 CVE-2021-3449 · GHSA-83mx-573x-5rw9

NULL pointer deref in signature_algorithms processing

Priority HIGH 68

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.63542 Published 2021-03-25 Fixed in 111.15.0 CWE-476
TI-2019-03845 CVE-2019-5436 · GHSA-8xvc-p9x4-w7jm

Heap-based buffer overflow in curl

Priority HIGH 67

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.49739 Published 2019-05-28 Partial fix CWE-122
TI-2021-05758 CVE-2021-22897 · GHSA-frcg-47mh-pj2g

Exposure of resource to wrong sphere in https://github.com/curl/curl

Priority MEDIUM 63

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.04265 Published 2021-06-11 Will not fix CWE-840
TI-2021-02646 CVE-2021-3712 · GHSA-q9wj-f4qw-6vfj

Read buffer overruns processing ASN.1 strings

Priority MEDIUM 63

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.48084 Published 2021-08-24 Partial fix · 111.16.0 CWE-125
TI-2021-05783 CVE-2021-22922 · GHSA-975f-fvhv-8mhx

Improper handling of exceptional conditions in https://github.com/curl/curl

Priority MEDIUM 62

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentf…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04332 Published 2021-08-05 Partial fix CWE-840
TI-2021-05808 CVE-2021-22947 · GHSA-94jh-wwgf-cmmc

Cryptographic flaw in https://github.com/curl/curl

Priority MEDIUM 60

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03009 Published 2021-09-29 Partial fix CWE-310
TI-2021-02414 CVE-2021-3450 · GHSA-8hfj-xrj2-pm22

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Priority MEDIUM 58

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.18339 Published 2021-03-25 Fixed in 111.15.0 CWE-295
TI-2019-02834 CVE-2019-3822 · GHSA-8wr2-mqj7-7vxp

Stack-based buffer overflow in curl

Priority MEDIUM 56

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12873 Published 2019-02-06 Partial fix CWE-121
TI-2022-06195 CVE-2022-21824 · GHSA-39wv-qjgj-4jxg

Prototype pollution in NodeJS Node

Priority MEDIUM 55

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21514 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-471
TI-2021-05806 CVE-2021-22945 · GHSA-22mx-9r92-42g8

Double free in https://github.com/curl/curl

Priority MEDIUM 55

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.06677 Published 2021-09-23 Will not fix CWE-415
TI-2021-05785 CVE-2021-22924 · GHSA-qhhj-q26m-mrw8

Improper input validation in https://github.com/curl/curl

Priority MEDIUM 51

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into ac…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0627 Published 2021-08-05 Partial fix CWE-20
Load more
Open these records in search →