Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

11 records in Storagetek Tape Analytics Sw Tool · all components

TI-2019-02266 CVE-2019-2725 · GHSA-m437-3crh-7475

Injection in Oracle Tape Library ACSLS

Priority CRITICAL 100KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99977 Published 2019-04-26 No fix listed CWE-74
TI-2015-04072 CVE-2015-4852 · GHSA-7r6v-mxc2-pg49

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and…

Priority CRITICAL 100KEV

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP por…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.94991 Published 2015-11-18 No fix listed CWE-502
TI-2019-02270 CVE-2019-2729 · GHSA-hmxx-vvw4-43vc

Improper access control in Oracle WebLogic Server

Priority CRITICAL 91

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.8883 Published 2019-06-19 No fix listed CWE-284
TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

Priority CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79
TI-2020-04467 CVE-2020-5421 · GHSA-rv39-3qh7-9v7w

RFD Protection Bypass via jsessionid

Priority MEDIUM 42

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.11564 Published 2020-09-19 Partial fix · 4.3.29, 5.0.19 +2 CWE-35
TI-2019-02759 CVE-2019-3740 · GHSA-7mmw-x6rm-hmr8

Cryptographic flaw in Dell RSA BSAFE Crypto-J

Priority LOW 35

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.03889 Published 2019-09-18 Fixed in 6.2.5 CWE-310
TI-2019-02758 CVE-2019-3739 · GHSA-p9w8-99j3-73rv

Cryptographic flaw in Dell RSA BSAFE Crypto-J

Priority LOW 34

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0263 Published 2019-09-18 Fixed in 6.2.5 CWE-310
TI-2019-02757 CVE-2019-3738 · GHSA-vq8w-mhc4-p67j

Improper signature verification in Dell RSA BSAFE Crypto-J

Priority LOW 32

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01681 Published 2019-09-18 Fixed in 6.2.5 CWE-325
TI-2020-07597 CVE-2020-9488 · GHSA-vwqq-5vrc-xw9h

Improper certificate validation in Apache Log4j

Priority LOW 29

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.08216 Published 2020-04-27 Partial fix · 2.12.3, 2.13.2 +1 CWE-295
Open these records in search →