Oracle vulnerabilities81 known to be exploited.
Oracle has 10,095 published vulnerabilities across 1,089 products in our catalogue. 81 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is MySQL, with 1,297. If you run Oracle software, patch the exploited flaws first.
The most recent Oracle flaw added to the known-exploited list is CVE-2016-3081, on 8 October 2026. We keep watching the known-exploited list.
Which Oracle products have the most vulnerabilities?
MySQL leads with 1,297 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Oracle vulnerabilities are being exploited?
81 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.1Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
- 7.5Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
- 9.8Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
- 7.5Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator.
- 9.8Oracle E-Business Suite Unspecified Vulnerability
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component.
- 9.8Jenkins Remote Code Execution Vulnerability
Jenkins contains a remote code execution vulnerability.
- 8.8Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
- 6.9JQuery Cross-Site Scripting (XSS) Vulnerability
JQuery contains a persistent cross-site scripting (XSS) vulnerability.
Which Oracle flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string...
- 98%CVE-2007-0882Critical
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip...
- 96%
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and...
- 95%CVE-2002-0840Medium
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers...
- 92%CVE-2008-0226High
Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2)...
- 90%CVE-2002-0656High
Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
- 85%CVE-2001-0499Critical
Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4)...
- 84%CVE-2008-3257Critical
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string,...
- 80%CVE-2004-0230Medium
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST...
- 78%CVE-2003-0780Critical
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.
All Oracle products we track.
884 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- MySQLmysql1,297 vulnerabilities676 versions
- JREjre778 vulnerabilities144 versions
- JDKjdk770 vulnerabilities114 versions
- Solarissolaris749 vulnerabilities13 versions
- Database Serverdatabase_server507 vulnerabilities137 versions
- VM Virtualboxvm_virtualbox385 vulnerabilities274 versions
- Peoplesoft Enterprise Peopletoolspeoplesoft_enterprise_peopletools345 vulnerabilities25 versions
- E-Business Suitee-business_suite327 vulnerabilities61 versions
- Fusion Middlewarefusion_middleware311 vulnerabilities124 versions
- Weblogic Serverweblogic_server299 vulnerabilities48 versions
- Mysql Servermysql_server229 vulnerabilities59 versions
- Linuxlinux226 vulnerabilities13 versions
- Application Serverapplication_server199 vulnerabilities78 versions
- Outside in Technologyoutside_in_technology195 vulnerabilities12 versions
- Graalvmgraalvm164 vulnerabilities71 versions
- Peoplesoft Productspeoplesoft_products158 vulnerabilities17 versions
- Jd Edwards Enterpriseone Toolsjd_edwards_enterpriseone_tools148 vulnerabilities24 versions
- Communications Cloud Native Core Policycommunications_cloud_native_core_policy125 vulnerabilities11 versions
- Retail Xstore Point of Serviceretail_xstore_point_of_service125 vulnerabilities52 versions
- Enterprise Manager Base Platformenterprise_manager_base_platform119 vulnerabilities18 versions
- Zfs Storage Appliance Kitzfs_storage_appliance_kit117 vulnerabilities1 version
- Enterprise Manager Ops Centerenterprise_manager_ops_center107 vulnerabilities14 versions
- Jrockitjrockit107 vulnerabilities63 versions
- HTTP Serverhttp_server102 vulnerabilities42 versions
This directory lists the 884 Oracle products with at least one tracked version, of 1,089 in our catalogue.
Running Oracle? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
- Matched to
- Oracle on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 10,095 published vulnerabilities across 1,089 products and 8,654 versions from Oracle. The most recent Oracle flaw added to the known-exploited list is CVE-2016-3081, on 8 October 2026.
81 Oracle vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2016-3081, CVE-2024-21182 and CVE-2025-61757. The full list is on this page.
MySQL, with 1,297 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Oracle products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.