Oracle
46 CVEs in CISA KEV — 13 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2023-21839 |
WebLogic Server | — | 0.9990 | 2023-05-01 | 2023-05-22 | Oracle WebLogic Server contains an unspecified vulnerability that allows an unau | |
CVE-2025-61882 |
E-Business Suite | — | 0.9973 | 2025-10-06 | 2025-10-27 | RW | Oracle E-Business Suite contains an unspecified vulnerability in the BI Publishe |
CVE-2026-35273 |
PeopleSoft Enterprise PeopleTools | — | 0.9668 | 2026-06-12 | 2026-06-15 | RW | Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for c |
CVE-2025-61884 |
E-Business Suite | — | 0.9589 | 2025-10-20 | 2025-11-10 | RW | Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerabil |
CVE-2025-61757 |
Fusion Middleware | — | 0.8865 | 2025-11-21 | 2025-12-12 | Oracle Fusion Middleware contains a missing authentication for critical function | |
CVE-2024-21182 |
WebLogic Server | — | 0.7416 | 2026-06-01 | 2026-06-04 | Oracle WebLogic contains an unspecified vulnerability that could allow an unauth | |
CVE-2026-21962 |
HTTP Server and Oracle Weblogic Server Proxy Plug-in | — | 0.7319 | 2026-08-24 | 2026-08-27 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper | |
CVE-2026-46817 |
E-Business Suite | — | 0.1231 | 2026-07-15 | 2026-07-18 | Oracle E-Business Suite contains an improper privilege management vulnerability | |
CVE-2024-20953 |
Agile Product Lifecycle Management (PLM) | — | 0.0393 | 2025-02-24 | 2025-03-17 | Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulne | |
CVE-2024-21287 |
Agile Product Lifecycle Management (PLM) | — | 0.0172 | 2024-11-21 | 2024-12-12 | Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorizat | |
CVE-2020-2883 |
WebLogic Server | — | — | 2025-01-07 | 2025-01-28 | Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a | |
CVE-2020-14644 |
WebLogic Server | — | — | 2024-09-18 | 2024-10-09 | Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a | |
CVE-2022-21445 |
ADF Faces | — | — | 2024-09-18 | 2024-10-09 | Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains | |
CVE-2017-3506 |
WebLogic Server | — | — | 2024-06-03 | 2024-06-24 | Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a | |
CVE-2020-2551 |
Fusion Middleware | — | — | 2023-11-16 | 2023-12-07 | Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core C | |
CVE-2016-3427 |
Java SE and JRockit | — | — | 2023-05-12 | 2023-06-02 | Oracle Java SE and JRockit contains an unspecified vulnerability that allows rem | |
CVE-2022-21587 |
E-Business Suite | — | — | 2023-02-02 | 2023-02-23 | RW | Oracle E-Business Suite contains an unspecified vulnerability that allows an una |
CVE-2021-35587 |
Fusion Middleware | — | — | 2022-11-28 | 2022-12-19 | Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with | |
CVE-2018-2628 |
WebLogic Server | — | — | 2022-09-08 | 2022-09-29 | Oracle WebLogic Server contains an unspecified vulnerability which can allow an | |
CVE-2019-3010 |
Solaris | — | — | 2022-05-25 | 2022-06-15 | Oracle Solaris component: XScreenSaver contains an unspecified vulnerability tha | |
CVE-2013-2423 |
Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows r | |
CVE-2013-0431 |
Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | RW | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora |
CVE-2013-0422 |
Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | RW | A vulnerability in the way Java restricts the permissions of Java applets could |
CVE-2012-1710 |
Fusion Middleware | — | — | 2022-05-25 | 2022-06-15 | RW | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in |
CVE-2010-0840 |
Java Runtime Environment (JRE) | — | — | 2022-05-25 | 2022-06-15 | Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE compo | |
CVE-2013-2465 |
Java SE | — | — | 2022-03-28 | 2022-04-18 | RW | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora |
CVE-2012-5076 |
Java SE | — | — | 2022-03-28 | 2022-04-18 | The default Java security properties configuration did not restrict access to th | |
CVE-2012-0518 |
Fusion Middleware | — | — | 2022-03-28 | 2022-04-18 | Unspecified vulnerability in the Oracle Application Server Single Sign-On compon | |
CVE-2019-2616 |
BI Publisher (Formerly XML Publisher) | — | — | 2022-03-25 | 2022-04-15 | Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerabili | |
CVE-2015-4902 |
Java SE | — | — | 2022-03-03 | 2022-03-24 | Unspecified vulnerability in Oracle Java SE allows remote attackers to affect in | |
CVE-2015-2590 |
Java SE | — | — | 2022-03-03 | 2022-03-24 | An unspecified vulnerability exists within Oracle Java Runtime Environment that | |
CVE-2012-4681 |
Java SE | — | — | 2022-03-03 | 2022-03-24 | RW | The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote |
CVE-2012-1723 |
Java SE | — | — | 2022-03-03 | 2022-03-24 | RW | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora |
CVE-2012-0507 |
Java SE | — | — | 2022-03-03 | 2022-03-24 | RW | An incorrect type vulnerability exists in the Concurrency component of Oracle's |
CVE-2011-3544 |
Java SE JDK and JRE | — | — | 2022-03-03 | 2022-03-24 | An access control vulnerability exists in the Applet Rhino Script Engine compone | |
CVE-2008-3431 |
VirtualBox | — | — | 2022-03-03 | 2022-03-24 | An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM Vi | |
CVE-2017-10271 |
WebLogic Server | — | — | 2022-02-10 | 2022-08-10 | RW | Oracle Corporation WebLogic Server contains a vulnerability that allows for remo |
CVE-2020-14864 |
Intelligence Enterprise Edition | — | — | 2022-01-18 | 2022-07-18 | Path traversal vulnerability, where an attacker can target the preview FilePath | |
CVE-2019-2725 |
WebLogic Server | — | — | 2022-01-10 | 2022-07-10 | RW | Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion |
CVE-2020-2555 |
Multiple Products | — | — | 2021-11-03 | 2022-05-03 | Multiple Oracle products contain a remote code execution vulnerability that allo | |
CVE-2012-3152 |
Fusion Middleware | — | — | 2021-11-03 | 2022-05-03 | Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability | |
CVE-2020-14871 |
Solaris and Zettabyte File System (ZFS) | — | — | 2021-11-03 | 2022-05-03 | Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulne | |
CVE-2015-4852 |
WebLogic Server | — | — | 2021-11-03 | 2022-05-03 | Oracle WebLogic Server contains a deserialization of untrusted data vulnerabilit | |
CVE-2020-14750 |
WebLogic Server | — | — | 2021-11-03 | 2022-05-03 | Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthe | |
CVE-2020-14882 |
WebLogic Server | — | — | 2021-11-03 | 2022-05-03 | Oracle WebLogic Server contains an unspecified vulnerability, which is assessed | |
CVE-2020-14883 |
WebLogic Server | — | — | 2021-11-03 | 2022-05-03 | Oracle WebLogic Server contains an unspecified vulnerability in the Console comp |