Oracle

Records14201All Threatist records

Exploited (KEV)82In CISA KEV

CVSS critical1606CVSS 9.0–10.0

CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV

TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CRITICAL 100KEV 2026-08-24 TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability CRITICAL 100KEV 2026-07-15 TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records

Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

38 records in Utilities Framework · all components

TI-2020-02258 CVE-2020-2555 · GHSA-gm93-pfh3-mrf3

Deserialization of untrusted data in Oracle WebCenter Portal

CRITICAL 100KEV

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97116 Published 2020-01-15 No fix listed CWE-502

TI-2021-16530 CVE-2021-39144 · GHSA-j9h8-phrw-h4fh

XStream is vulnerable to a Remote Command Execution attack

CRITICAL 96KEV

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.98124 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2020-11591 CVE-2020-14756 · GHSA-p7pp-gqpg-99cg

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component…

CRITICAL 88

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74924 Published 2021-01-20 No fix listed

TI-2019-07494 CVE-2019-10173 · GHSA-hf23-9pf7-388p

Code injection in xstream

CRITICAL 86

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95036 Published 2019-07-23 Fixed in 1.4.11 CWE-94

TI-2021-20437 CVE-2021-45105 · GHSA-p6xc-xr62-6r2g

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

HIGH 72

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.99999 Published 2021-12-18 Partial fix · 2.17.0, 2.12.3 +5 CWE-20

TI-2021-16528 CVE-2021-39141 · GHSA-g5w6-mrj7-75h2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 61

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.16118 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2019-07411 CVE-2019-10086 · GHSA-6phf-73q6-gh87

Deserialization of untrusted data in Apache Commons Beanutils

MEDIUM 61

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.29082 Published 2019-08-20 Partial fix · 1.9.4 CWE-502

TI-2021-16532 CVE-2021-39146 · GHSA-p8pq-r894-fm8f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 60

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.143 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2018-05845 CVE-2018-8088 · GHSA-w77p-8cfg-2x43

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows…

MEDIUM 58

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14703 Published 2018-03-20 Partial fix · 1.7.26, 1.8.0-beta4 CWE-284

TI-2021-16538 CVE-2021-39152 · GHSA-xw4p-crpj-vjx2

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

MEDIUM 56

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.11377 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2020-15666 CVE-2020-25649 · GHSA-288c-cq4h-88gq

XML external entity injection in jackson-databind

MEDIUM 56

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.17714 Published 2020-12-03 Partial fix · 2.6.7.4, 2.9.10.7 +1 CWE-611

TI-2021-16526 CVE-2021-39139 · GHSA-64xx-cq4q-mf44

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 53

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0454 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16540 CVE-2021-39154 · GHSA-6w62-hx7r-mw68

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16539 CVE-2021-39153 · GHSA-2q8x-2p7f-574v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04457 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16537 CVE-2021-39151 · GHSA-hph2-m3g5-xxv4

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16535 CVE-2021-39149 · GHSA-3ccq-5vw3-2p6x

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16534 CVE-2021-39148 · GHSA-qrx8-8545-4wg2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16533 CVE-2021-39147 · GHSA-h7v4-7xg3-hxcc

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16531 CVE-2021-39145 · GHSA-8jrj-525p-826v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04065 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2020-08586 CVE-2020-10683 · GHSA-hwj3-m3p6-hj38

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by…

MEDIUM 52

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07269 Published 2020-05-01 Partial fix · 2.0.3, 2.1.3 CWE-611

TI-2021-16536 CVE-2021-39150 · GHSA-cxfm-5m4g-x7xp

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

MEDIUM 51

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.03437 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2019-13041 CVE-2019-17495 · GHSA-c427-hjc3-wrfw

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11…

MEDIUM 51

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltr…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05734 Published 2019-10-10 Fixed in 3.23.11, 2.10.0 CWE-352

TI-2015-07630 CVE-2015-9251 · GHSA-rmxg-73gg-4p98

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a…

MEDIUM 51

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.29726 Published 2018-01-18 Partial fix · 1.12.2, 3.0.0 +1 CWE-79

TI-2020-09639 CVE-2020-11979 · GHSA-f62v-xpxf-3v68

Injection in Apache Ant

MEDIUM 49

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07757 Published 2020-10-01 Partial fix · 1.10.9 CWE-379

TI-2020-18753 CVE-2020-36518 · GHSA-57j2-w4cx-62h2

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of…

MEDIUM 47

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0486 Published 2022-03-11 Partial fix · 2.13.2.1, 2.12.6.1 CWE-787

Open these records in search →

Critical	1606
High	4615
Medium	6805
Low	1173
No CVSS	2