Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

362 records in Weblogic Server · all components

TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2019-02266 CVE-2019-2725 · GHSA-m437-3crh-7475

Injection in Oracle Tape Library ACSLS

Priority CRITICAL 100KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99977 Published 2019-04-26 No fix listed CWE-74
TI-2018-01947 CVE-2018-2628 · GHSA-882j-m7wv-38p6

Deserialization of untrusted data in Oracle WebLogic Server

Priority CRITICAL 100KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99958 Published 2018-04-19 No fix listed CWE-502
TI-2017-03639 CVE-2017-5638 · GHSA-j77q-2qqg-6989

Improper handling of exceptional conditions in Apache Struts

Priority CRITICAL 100KEV

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to ex…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2017-03-11 Fixed in 2.3.32, 2.5.10.1 CWE-755
TI-2015-04072 CVE-2015-4852 · GHSA-7r6v-mxc2-pg49

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and…

Priority CRITICAL 100KEV

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP por…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.94991 Published 2015-11-18 No fix listed CWE-502
TI-2018-02532 CVE-2018-3245 · GHSA-4562-f76f-q78f

Deserialization of untrusted data in Oracle WebLogic Server

Priority CRITICAL 93

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.94281 Published 2018-10-17 No fix listed CWE-502
TI-2017-02702 CVE-2017-3506 · GHSA-2f3c-chf6-54v5

OS command injection in Oracle WebLogic Server

Priority CRITICAL 92KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.95991 Published 2017-04-24 No fix listed CWE-78
TI-2016-02970 CVE-2016-3510 · GHSA-88m7-cp4v-hhw3

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion…

Priority CRITICAL 92

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors re…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.91402 Published 2016-07-21 No fix listed
TI-2019-02270 CVE-2019-2729 · GHSA-hmxx-vvw4-43vc

Improper access control in Oracle WebLogic Server

Priority CRITICAL 91

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.8883 Published 2019-06-19 No fix listed CWE-284
TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

Priority CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502
TI-2023-08217 CVE-2023-21839 · GHSA-f8x3-c29w-wfmj

Missing authentication in Oracle WebLogic Server

Priority CRITICAL 90KEV

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.999 Published 2023-01-17 No fix listed CWE-306
TI-2017-07622 CVE-2017-10271 · GHSA-h7p4-68h5-84f3

Missing authentication in Oracle WebLogic Server

Priority CRITICAL 90KEV

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99994 Published 2017-10-19 No fix listed CWE-306
TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

Priority CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79
TI-2019-13113 CVE-2019-17571 · GHSA-2qrg-x229-3v8q

Deserialization of untrusted data in Apache Log4j

Priority CRITICAL 86

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6998 Published 2019-12-20 Partial fix CWE-502
TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

Priority CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89
Load more
Open these records in search →