[ Vendor · 68 CVEs ]
Oracle
CVEs affecting Oracle published in the last 30 days, plus any Oracle CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-35273 | 11 Jun 2026 | CVSS 9.8 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions… | Exploited |
| CVE-2026-46817 | 28 May 2026 | CVSS 9.8 | Oracle E-Business Suite Improper Privilege ManagementVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are… | Exploited |
| CVE-2026-21962 | 20 Jan 2026 | CVSS 10.0 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access ControlVulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy… | ExploitedFix |
| CVE-2025-61757 | 21 Oct 2025 | CVSS 9.8 | Oracle Fusion Middleware Missing Authentication for Critical FunctionVulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are… | Exploited |
| CVE-2025-61884 | 12 Oct 2025 | CVSS 7.5 | Oracle E-Business Suite Server-Side Request Forgery (SSRF)Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are… | Exploited |
| CVE-2025-61882 | 5 Oct 2025 | CVSS 9.8 | Oracle E-Business Suite UnspecifiedVulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that… | Exploited |
| CVE-2024-21287 | 18 Nov 2024 | CVSS 7.5 | Oracle Agile Product Lifecycle Management (PLM) Incorrect AuthorizationVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The… | Exploited |
| CVE-2024-21182 | 16 Jul 2024 | CVSS 7.5 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2024-20953 | 17 Feb 2024 | CVSS 8.8 | Oracle Agile Product Lifecycle Management (PLM) DeserializationVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily… | Exploited |
| CVE-2024-20953 | 17 Feb 2024 | CVSS 8.8 | Oracle Agile Product Lifecycle Management (PLM) DeserializationVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily… | Exploited |
| CVE-2023-41993 | 21 Sep 2023 | CVSS 8.8 | Apple Multiple Products WebKit Code ExecutionThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution… | Exploited |
| CVE-2023-21839 | 18 Jan 2023 | CVSS 7.5 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | ExploitedFix |
| CVE-2022-21587 | 18 Oct 2022 | CVSS 9.8 | Oracle E-Business Suite UnspecifiedVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are… | ExploitedFix |
| CVE-2022-21445 | 19 Apr 2022 | CVSS 9.8 | Oracle ADF Faces Deserialization of Untrusted DataVulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions… | Exploited |
| CVE-2022-21445 | 19 Apr 2022 | CVSS 9.8 | Oracle ADF Faces Deserialization of Untrusted DataVulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions… | Exploited |
| CVE-2021-35587 | 19 Jan 2022 | CVSS 9.8 | Oracle Fusion Middleware UnspecifiedVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are… | Exploited |
| CVE-2021-3156 | 26 Jan 2021 | CVSS 7.8 | Sudo Heap-Based Buffer OverflowSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via… | ExploitedFix |
| CVE-2020-14750 | 2 Nov 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | ExploitedFix |
| CVE-2020-14882 | 21 Oct 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | Exploited |
| CVE-2020-14883 | 21 Oct 2020 | CVSS 7.2 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | Exploited |
| CVE-2020-14864 | 21 Oct 2020 | CVSS 7.5 | Oracle Business Intelligence Enterprise Edition Path TransversalVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported… | Exploited |
| CVE-2020-14871 | 21 Oct 2020 | CVSS 10.0 | Oracle Solaris and Zettabyte File System (ZFS) UnspecifiedVulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are… | ExploitedFix |
| CVE-2020-14871 | 21 Oct 2020 | CVSS 10.0 | Oracle Solaris and Zettabyte File System (ZFS) UnspecifiedVulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are… | ExploitedFix |
| CVE-2020-14644 | 15 Jul 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2020-14644 | 15 Jul 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2020-2883 | 15 Apr 2020 | CVSS 9.8 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are… | Exploited |
| CVE-2020-2551 | 15 Jan 2020 | CVSS 9.8 | Oracle Fusion Middleware UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are… | ExploitedFix |
| CVE-2020-2555 | 15 Jan 2020 | CVSS 9.8 | Oracle Multiple Products Remote Code ExecutionVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are… | ExploitedFix |
| CVE-2019-3010 | 16 Oct 2019 | CVSS 8.8 | Oracle Solaris Privilege EscalationVulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily… | ExploitedFix |
| CVE-2019-2725 | 26 Apr 2019 | CVSS 9.8 | Oracle WebLogic Server, InjectionVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected… | ExploitedFix |
| CVE-2019-2616 | 23 Apr 2019 | CVSS 7.2 | Oracle BI Publisher Unauthorized AccessVulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported… | ExploitedFix |
| CVE-2018-2628 | 19 Apr 2018 | CVSS 9.8 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are… | ExploitedFix |
| CVE-2017-1000353 | 29 Jan 2018 | CVSS 9.8 | Jenkins Remote Code ExecutionJenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated… | ExploitedFix |
| CVE-2017-17562 | 12 Dec 2017 | CVSS 8.1 | Embedthis GoAhead Remote Code ExecutionEmbedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of… | ExploitedFix |
| CVE-2017-10271 | 19 Oct 2017 | CVSS 7.5 | Oracle Corporation WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected… | ExploitedFix |
| CVE-2017-9841 | 27 Jun 2017 | CVSS 9.8 | PHPUnit Command InjectionUtil/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data… | ExploitedFix |
| CVE-2017-3506 | 24 Apr 2017 | CVSS 7.4 | Oracle WebLogic Server OS Command InjectionVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected… | ExploitedFix |
| CVE-2017-3506 | 24 Apr 2017 | CVSS 7.4 | Oracle WebLogic Server OS Command InjectionVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected… | ExploitedFix |
| CVE-2016-3718 | 5 May 2016 | CVSS 5.5 | ImageMagick Server-Side Request Forgery (SSRF)The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery… | ExploitedFix |
| CVE-2016-3715 | 5 May 2016 | CVSS 5.5 | ImageMagick Arbitrary File DeletionThe EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | ExploitedFix |
| CVE-2016-3081 | 26 Apr 2016 | CVSS 8.1 | Remote code execution in Apache Struts with Dynamic Method InvocationApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to… | ExploitedFix |
| CVE-2016-3427 | 21 Apr 2016 | CVSS 9.8 | Oracle Java SE and JRockit UnspecifiedUnspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-5287 | 7 Dec 2015 | CVSS 7.8 | Red Hat Automatic Bug Reporting Tool Privilege EscalationThe abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges… | ExploitedFix |
| CVE-2015-4852 | 18 Nov 2015 | CVSS 9.8 | Oracle WebLogic Server Deserialization of Untrusted DataThe WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands… | ExploitedFix |
| CVE-2015-4902 | 22 Oct 2015 | CVSS 5.3 | Oracle Java SE Integrity CheckUnspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to… | ExploitedFix |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-2590 | 16 Jul 2015 | CVSS 9.8 | Oracle Java SE and Java SE Embedded Remote Code ExecutionUnspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect… | ExploitedFix |
| CVE-2014-7169 | 25 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which… | ExploitedFix |
| CVE-2014-6271 | 24 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-3153 | 7 Jun 2014 | CVSS 7.8 | Linux Kernel Privilege EscalationThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which… | ExploitedFix |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |
| CVE-2013-2251 | 20 Jul 2013 | CVSS 9.8 | Apache Struts Improper Input ValidationApache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2)… | ExploitedFix |
| CVE-2013-2465 | 18 Jun 2013 | CVSS 9.8 | Oracle Java SE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0… | ExploitedFix |
| CVE-2013-2423 | 17 Apr 2013 | CVSS 3.7 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote… | ExploitedFix |
| CVE-2013-0431 | 31 Jan 2013 | CVSS 3.7 | Oracle JRE Sandbox BypassUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted… | Exploited |
| CVE-2013-0422 | 10 Jan 2013 | CVSS 9.8 | Oracle JRE Remote Code ExecutionMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public… | Exploited |
| CVE-2012-0518 | 16 Oct 2012 | CVSS 4.7 | Oracle Fusion Middleware UnspecifiedUnspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to… | ExploitedFix |
| CVE-2012-3152 | 16 Oct 2012 | CVSS 9.1 | Oracle Fusion Middleware UnspecifiedUnspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote… | ExploitedFix |
| CVE-2012-5076 | 16 Oct 2012 | CVSS 9.8 | Oracle Java SE Sandbox BypassUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect… | ExploitedFix |
| CVE-2012-4681 | 28 Aug 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionMultiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute… | Exploited |
| CVE-2012-1723 | 16 Jun 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update… | Exploited |
| CVE-2012-0507 | 7 Jun 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0… | Exploited |
| CVE-2012-1710 | 3 May 2012 | CVSS 9.8 | Oracle Fusion Middleware UnspecifiedUnspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect… | ExploitedFix |
| CVE-2011-3544 | 19 Oct 2011 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote… | ExploitedFix |
| CVE-2010-0840 | 1 Apr 2010 | CVSS 9.8 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25… | ExploitedFix |
| CVE-2008-2992 | 4 Nov 2008 | CVSS 7.8 | Adobe Reader and Acrobat Input ValidationStack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls… | ExploitedFix |
| CVE-2008-3431 | 5 Aug 2008 | CVSS 8.8 | Oracle VirtualBox Insufficient Input ValidationThe VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and… | Exploited |