By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Oracle flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access ControlExploited since Aug 24, 2026 · CVSS 10
- CVE-2026-46817 Oracle E-Business Suite Improper Privilege ManagementExploited since Jul 15, 2026 · CVSS 9.8
- CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionExploited since Jun 12, 2026 · ransomware · CVSS 9.8
- CVE-2024-21182 Oracle WebLogic Server UnspecifiedExploited since Jun 1, 2026 · CVSS 7.5
- CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical FunctionExploited since Nov 21, 2025 · CVSS 9.8
- CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF)Exploited since Oct 20, 2025 · ransomware · CVSS 7.5
- CVE-2025-61882 Oracle E-Business Suite UnspecifiedExploited since Oct 6, 2025 · ransomware · CVSS 9.8
- CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) DeserializationExploited since Feb 24, 2025 · CVSS 8.8
- CVE-2020-2883 Oracle WebLogic Server UnspecifiedExploited since Jan 7, 2025 · CVSS 9.8
- CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect AuthorizationExploited since Nov 21, 2024 · CVSS 7.5
- CVE-2022-21445 Oracle ADF Faces Deserialization of Untrusted DataExploited since Sep 18, 2024 · CVSS 9.8
- CVE-2020-14644 Oracle WebLogic Server Remote Code ExecutionExploited since Sep 18, 2024 · CVSS 9.8
- CVE-2017-3506 Oracle WebLogic Server OS Command InjectionExploited since Jun 3, 2024 · CVSS 7.4
- CVE-2020-2551 Oracle Fusion Middleware UnspecifiedExploited since Nov 16, 2023 · CVSS 9.8
- CVE-2016-3427 Oracle Java SE and JRockit UnspecifiedExploited since May 12, 2023 · CVSS 9.8
- CVE-2023-21839 Oracle WebLogic Server UnspecifiedExploited since May 1, 2023 · CVSS 7.5
- CVE-2022-21587 Oracle E-Business Suite UnspecifiedExploited since Feb 2, 2023 · ransomware · CVSS 9.8
- CVE-2021-35587 Oracle Fusion Middleware UnspecifiedExploited since Nov 28, 2022 · CVSS 9.8
- CVE-2018-2628 Oracle WebLogic Server UnspecifiedExploited since Sep 8, 2022 · CVSS 9.8
- CVE-2013-0431 Oracle JRE Sandbox BypassExploited since May 25, 2022 · ransomware · CVSS 3.7
- CVE-2019-3010 Oracle Solaris Privilege EscalationExploited since May 25, 2022 · CVSS 8.8
- CVE-2010-0840 Oracle JRE UnspecifiedExploited since May 25, 2022 · CVSS 9.8
- CVE-2012-1710 Oracle Fusion Middleware UnspecifiedExploited since May 25, 2022 · ransomware · CVSS 9.8
- CVE-2013-0422 Oracle JRE Remote Code ExecutionExploited since May 25, 2022 · ransomware · CVSS 9.8
- CVE-2013-2423 Oracle JRE UnspecifiedExploited since May 25, 2022 · CVSS 3.7
- CVE-2013-2465 Oracle Java SE UnspecifiedExploited since Mar 28, 2022 · ransomware · CVSS 9.8
- CVE-2012-5076 Oracle Java SE Sandbox BypassExploited since Mar 28, 2022 · CVSS 9.8
- CVE-2012-0518 Oracle Fusion Middleware UnspecifiedExploited since Mar 28, 2022 · CVSS 4.7
- CVE-2019-2616 Oracle BI Publisher Unauthorized AccessExploited since Mar 25, 2022 · CVSS 7.2
- CVE-2008-3431 Oracle VirtualBox Insufficient Input ValidationExploited since Mar 3, 2022 · CVSS 8.8
- CVE-2015-4902 Oracle Java SE Integrity CheckExploited since Mar 3, 2022 · CVSS 5.3
- CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code ExecutionExploited since Mar 3, 2022 · CVSS 9.8
- CVE-2012-4681 Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionExploited since Mar 3, 2022 · ransomware · CVSS 9.8
- CVE-2012-1723 Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionExploited since Mar 3, 2022 · ransomware · CVSS 9.8
- CVE-2012-0507 Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionExploited since Mar 3, 2022 · ransomware · CVSS 9.8
- CVE-2011-3544 Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionExploited since Mar 3, 2022 · CVSS 9.8
- CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code ExecutionExploited since Feb 10, 2022 · ransomware · CVSS 7.5
- CVE-2020-14864 Oracle Business Intelligence Enterprise Edition Path TransversalExploited since Jan 18, 2022 · CVSS 7.5
- CVE-2019-2725 Oracle WebLogic Server, InjectionExploited since Jan 10, 2022 · ransomware · CVSS 9.8
- CVE-2020-14882 Oracle WebLogic Server Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) UnspecifiedExploited since Nov 3, 2021 · CVSS 10
- CVE-2015-4852 Oracle WebLogic Server Deserialization of Untrusted DataExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2012-3152 Oracle Fusion Middleware UnspecifiedExploited since Nov 3, 2021 · CVSS 9.1
- CVE-2020-2555 Oracle Multiple Products Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2020-14750 Oracle WebLogic Server Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2020-14883 Oracle WebLogic Server UnspecifiedExploited since Nov 3, 2021 · CVSS 7.2
Latest high and critical flaws
- CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).Critical 9.1 · Oct 24, 2026
- CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).Critical 9.1 · Oct 21, 2026
- CVE-2026-91668 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).High 8.8 · Oct 20, 2026
- CVE-2026-91665 Vulnerability in Oracle Essbase (component: Security).Critical 9.8 · Oct 20, 2026
- CVE-2026-91664 Vulnerability in Oracle Essbase (component: Security).High 7.5 · Oct 20, 2026
- CVE-2026-91663 Vulnerability in Oracle Essbase (component: Security).Critical 9.9 · Oct 20, 2026
- CVE-2026-91661 Vulnerability in Oracle Essbase (component: Security).High 7.7 · Oct 20, 2026
- CVE-2026-91659 Vulnerability in Oracle Essbase (component: Build).High 7.7 · Oct 20, 2026
- CVE-2026-91658 Vulnerability in Oracle Essbase (component: Security).Critical 9.9 · Oct 20, 2026
- CVE-2026-91656 Vulnerability in Oracle Essbase (component: Federated Partitions).Critical 9.1 · Oct 20, 2026
- CVE-2026-91655 Vulnerability in Oracle Essbase (component: Security).Critical 9.1 · Oct 20, 2026
- CVE-2026-91653 Vulnerability in Oracle Essbase (component: Essbase Web Platform).High 8.5 · Oct 20, 2026
- CVE-2026-91651 Vulnerability in Oracle Essbase (component: Essbase Web Platform).High 8.5 · Oct 20, 2026
- CVE-2026-91647 Vulnerability in Oracle Essbase (component: Security).High 8.1 · Oct 20, 2026
- CVE-2026-91644 Vulnerability in Oracle Essbase (component: Security).Critical 9.3 · Oct 20, 2026
- CVE-2026-91642 Vulnerability in Oracle Essbase (component: Security).High 7.3 · Oct 20, 2026
- CVE-2026-91639 Vulnerability in Oracle Essbase (component: Security).High 7.7 · Oct 20, 2026
- CVE-2026-91638 Vulnerability in Oracle Essbase (component: Security).Critical 9.9 · Oct 20, 2026
- CVE-2026-91637 Vulnerability in Oracle Essbase (component: Security).Critical 9.9 · Oct 20, 2026
- CVE-2026-91636 Vulnerability in Oracle Essbase (component: Security).High 7.7 · Oct 20, 2026
- CVE-2026-91635 Vulnerability in Oracle Essbase (component: Security).High 8.1 · Oct 20, 2026
- CVE-2026-91632 Vulnerability in Oracle Essbase (component: Security).High 7.7 · Oct 20, 2026
- CVE-2026-91627 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).High 7.8 · Oct 20, 2026
- CVE-2026-91625 Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).High 8.2 · Oct 20, 2026
- CVE-2026-91624 Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).Critical 9.1 · Oct 20, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.