Oracle vulnerabilities
We track 3,014 vulnerabilities in Oracle products across 60+ products. 3,006 are rated high or critical, and 81 have been exploited in real attacks. The most recent was published on October 24, 2026.
Latest Oracle vulnerabilities
- 8.8 High severity
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc
- 8.8 High severity
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc
- 9.3 Critical severity
Oracle WebCenter Content: Improper Access Control
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc
- 9.3 Critical severity
Oracle WebCenter Content: Improper Access Control
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc
- 7.5 High severity
Oracle JDeveloper: Improper Access Control
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with networ
- 9.9 Critical severity
JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTT
- 7.8 High severity
Oracle Data Integrator: Incorrect Authorization
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastru
- 7.1 High severity
MySQL Connectors: Missing Authentication for Critical Functionality
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compro
- 7.5 High severity
Oracle JDeveloper: Improper Access Control
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 8.1 High severity
JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via H
- 7.5 High severity
JD Edwards EnterpriseOne HCM Foundation: Improper Privilege Management
Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: Time Accounting and HRM Base). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network a
- 8.8 High severity
JD Edwards EnterpriseOne Procurement and…: Missing Authentication for Critical Functionality
Vulnerability in the JD Edwards EnterpriseOne Procurement and Subcontract Management product of Oracle JD Edwards (component: Procurement). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with netw
- 8.2 High severity
PeopleSoft Enterprise CS Campus Community: Improper Authentication
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t
- 7.1 High severity
PeopleSoft Enterprise CS Campus Community: Improper Access Control
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Person Data). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HT
- 9.1 Critical severity
PeopleSoft Enterprise CC Common Application…: Improper Access Control
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with
- 7.5 High severity
PeopleSoft Enterprise CS Student Records: Missing Authentication for Critical Functionality
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker wi
- 7.5 High severity
PeopleSoft Enterprise CS Campus Community: Missing Authentication for Critical Functionality
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP
- 8.8 High severity
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft…
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access v
- 8.8 High severity
PeopleSoft Enterprise CS Student Financials: Missing Authentication for Critical Functionality
Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Billing). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t
- 7.8 High severity
PeopleSoft Enterprise FIN Project Costing: Missing Authentication for Critical Functionality
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure
- 8.1 High severity
PeopleSoft Enterprise CS Student Records: Improper Authentication
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via
- 7.5 High severity
PeopleSoft Enterprise CS Student Records: Improper Authentication
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access v
- 8.7 High severity
PeopleSoft Enterprise FIN Cash Management: Improper Access Control
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via
- 8.8 High severity
PeopleSoft Enterprise CS Campus Community: Improper Access Control
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network
- 7.5 High severity
PeopleSoft Enterprise FIN Staffing Front Office: Improper Access Control
Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network a
- 7.7 High severity
MySQL Connectors: Missing Authentication for Critical Functionality
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromi
- 7.6 High severity
Oracle Transportation Management: Improper Access Control
Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c
- 8.8 High severity
Oracle Transportation Management: Improper Privilege Management
Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi
- 8.3 High severity
Oracle Enterprise Command Center Framework: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to
- 7.5 High severity
Oracle Enterprise Command Center Framework: Improper Access Control
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical
- 8.8 High severity
Oracle Enterprise Command Center Framework: Missing Authentication for Critical Functionality
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical co
- 8.0 High severity
Oracle Enterprise Command Center Framework: Improper Authentication
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical
- 7.6 High severity
Oracle Enterprise Command Center Framework: Improper Authentication
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP t
- 7.1 High severity
Oracle Enterprise Command Center Framework: Improper Authentication
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to
- 7.2 High severity
Oracle Enterprise Command Center Framework: Improper Privilege Management
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP t
- 7.8 High severity
Oracle GoldenGate: Improper Access Control
Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Or
- 9.9 Critical severity
Oracle WebCenter Portal: Improper Authentication
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access
- 9.1 Critical severity
Oracle Identity Manager: Improper Privilege Management
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces
- 9.8 Critical severity
Oracle WebCenter Portal: Improper Privilege Management
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces
- 9.9 Critical severity
Oracle WebCenter Portal: Improper Access Control
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access