# Oracle vulnerabilities

> Oracle has 10,095 published vulnerabilities across 1,089 products in our catalogue. 81 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is MySQL, with 1,297. If you run Oracle software, patch the exploited flaws first.

Canonical page: https://www.precursorintelligence.com/vendors/oracle

## At a glance

- **Published vulnerabilities:** 10,095
- **Known to be exploited:** 81
- **Products:** 1,089
- **Versions:** 8,654
- **Most recently added to the known-exploited list:** [CVE-2016-3081](https://www.precursorintelligence.com/what-is/cve-2016-3081), 8 October 2026. We keep watching the list.

## Which Oracle products have the most vulnerabilities?

- [MySQL](https://www.precursorintelligence.com/product/oracle/mysql): 1,297 published vulnerabilities, 676 versions
- [JRE](https://www.precursorintelligence.com/product/oracle/jre): 778 published vulnerabilities, 144 versions
- [JDK](https://www.precursorintelligence.com/product/oracle/jdk): 770 published vulnerabilities, 114 versions
- [Solaris](https://www.precursorintelligence.com/product/oracle/solaris): 749 published vulnerabilities, 13 versions
- [Database Server](https://www.precursorintelligence.com/product/oracle/database_server): 507 published vulnerabilities, 137 versions
- [VM Virtualbox](https://www.precursorintelligence.com/product/oracle/vm_virtualbox): 385 published vulnerabilities, 274 versions
- [Peoplesoft Enterprise Peopletools](https://www.precursorintelligence.com/product/oracle/peoplesoft_enterprise_peopletools): 345 published vulnerabilities, 25 versions
- [E-Business Suite](https://www.precursorintelligence.com/product/oracle/e-business_suite): 327 published vulnerabilities, 61 versions
- [Fusion Middleware](https://www.precursorintelligence.com/product/oracle/fusion_middleware): 311 published vulnerabilities, 124 versions
- [Weblogic Server](https://www.precursorintelligence.com/product/oracle/weblogic_server): 299 published vulnerabilities, 48 versions

Each product page lists its own known-exploited flaws.

## Which Oracle vulnerabilities are being exploited?

81 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2016-3081](https://www.precursorintelligence.com/what-is/cve-2016-3081): Apache Struts Command Injection Vulnerability. High, CVSS 8.1, chance of use in 30 days 96%, known exploited since 8 October 2026.
- [CVE-2024-21182](https://www.precursorintelligence.com/what-is/cve-2024-21182): Oracle WebLogic Server Unspecified Vulnerability. High, CVSS 7.5, chance of use in 30 days 74%, known exploited since 1 June 2026.
- [CVE-2025-61757](https://www.precursorintelligence.com/what-is/cve-2025-61757): Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 89%, known exploited since 21 November 2025.
- [CVE-2025-61884](https://www.precursorintelligence.com/what-is/cve-2025-61884): Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability. High, CVSS 7.5, chance of use in 30 days 96%, known exploited since 20 October 2025.
- [CVE-2025-61882](https://www.precursorintelligence.com/what-is/cve-2025-61882): Oracle E-Business Suite Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 6 October 2025.
- [CVE-2017-1000353](https://www.precursorintelligence.com/what-is/cve-2017-1000353): Jenkins Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 2 October 2025.
- [CVE-2024-20953](https://www.precursorintelligence.com/what-is/cve-2024-20953): Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability. High, CVSS 8.8, chance of use in 30 days 3.9%, known exploited since 24 February 2025.
- [CVE-2020-11023](https://www.precursorintelligence.com/what-is/cve-2020-11023): JQuery Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.9, chance of use in 30 days 85%, known exploited since 23 January 2025.
- [CVE-2020-2883](https://www.precursorintelligence.com/what-is/cve-2020-2883): Oracle WebLogic Server Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 7 January 2025.
- [CVE-2024-21287](https://www.precursorintelligence.com/what-is/cve-2024-21287): Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability. High, CVSS 7.5, chance of use in 30 days 1.7%, known exploited since 21 November 2024.
- [CVE-2022-21445](https://www.precursorintelligence.com/what-is/cve-2022-21445): Oracle ADF Faces Deserialization of Untrusted Data Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 62%, known exploited since 18 September 2024.
- [CVE-2020-14644](https://www.precursorintelligence.com/what-is/cve-2020-14644): Oracle WebLogic Server Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 18 September 2024.
- [CVE-2017-3506](https://www.precursorintelligence.com/what-is/cve-2017-3506): Oracle WebLogic Server OS Command Injection Vulnerability. High, CVSS 7.4, chance of use in 30 days 96%, known exploited since 3 June 2024.
- [CVE-2020-2551](https://www.precursorintelligence.com/what-is/cve-2020-2551): Oracle Fusion Middleware Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 93%, known exploited since 16 November 2023.
- [CVE-2023-41993](https://www.precursorintelligence.com/what-is/cve-2023-41993): Apple Multiple Products WebKit Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 24%, known exploited since 25 September 2023.
- [CVE-2016-8735](https://www.precursorintelligence.com/what-is/cve-2016-8735): Apache Tomcat Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 90%, known exploited since 12 May 2023.
- [CVE-2016-3427](https://www.precursorintelligence.com/what-is/cve-2016-3427): Oracle Java SE and JRockit Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 92%, known exploited since 12 May 2023.
- [CVE-2014-0196](https://www.precursorintelligence.com/what-is/cve-2014-0196): Linux Kernel Race Condition Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 22%, known exploited since 12 May 2023.
- [CVE-2023-21839](https://www.precursorintelligence.com/what-is/cve-2023-21839): Oracle WebLogic Server Unspecified Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 1 May 2023.
- [CVE-2021-39144](https://www.precursorintelligence.com/what-is/cve-2021-39144): XStream Remote Code Execution Vulnerability. High, CVSS 8.5, chance of use in 30 days 98%, known exploited since 10 March 2023.
- [CVE-2022-21587](https://www.precursorintelligence.com/what-is/cve-2022-21587): Oracle E-Business Suite Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 2 February 2023.
- [CVE-2021-35587](https://www.precursorintelligence.com/what-is/cve-2021-35587): Oracle Fusion Middleware Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 96%, known exploited since 28 November 2022.
- [CVE-2018-2628](https://www.precursorintelligence.com/what-is/cve-2018-2628): Oracle WebLogic Server Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 8 September 2022.
- [CVE-2022-22963](https://www.precursorintelligence.com/what-is/cve-2022-22963): VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 August 2022.
- [CVE-2021-4034](https://www.precursorintelligence.com/what-is/cve-2021-4034): Red Hat Polkit Out-of-Bounds Read and Write Vulnerability. High, CVSS 7.8, chance of use in 30 days 95%, known exploited since 27 June 2022.
- [CVE-2012-0754](https://www.precursorintelligence.com/what-is/cve-2012-0754): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 8.1, chance of use in 30 days 91%, known exploited since 8 June 2022.
- [CVE-2011-0609](https://www.precursorintelligence.com/what-is/cve-2011-0609): Adobe Flash Player Unspecified Vulnerability. High, CVSS 7.8, chance of use in 30 days 64%, known exploited since 8 June 2022.
- [CVE-2012-0767](https://www.precursorintelligence.com/what-is/cve-2012-0767): Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 6.2%, known exploited since 8 June 2022.
- [CVE-2012-1710](https://www.precursorintelligence.com/what-is/cve-2012-1710): Oracle Fusion Middleware Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 7.8%, known exploited since 25 May 2022.
- [CVE-2010-0840](https://www.precursorintelligence.com/what-is/cve-2010-0840): Oracle JRE Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 96%, known exploited since 25 May 2022.
- [CVE-2013-0422](https://www.precursorintelligence.com/what-is/cve-2013-0422): Oracle JRE Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 25 May 2022.
- [CVE-2015-4495](https://www.precursorintelligence.com/what-is/cve-2015-4495): Mozilla Firefox Security Feature Bypass Vulnerability. High, CVSS 8.8, chance of use in 30 days 69%, known exploited since 25 May 2022.
- [CVE-2019-3010](https://www.precursorintelligence.com/what-is/cve-2019-3010): Oracle Solaris Privilege Escalation Vulnerability. High, CVSS 8.8, chance of use in 30 days 13%, known exploited since 25 May 2022.
- [CVE-2014-3153](https://www.precursorintelligence.com/what-is/cve-2014-3153): Linux Kernel Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 37%, known exploited since 25 May 2022.
- [CVE-2013-2423](https://www.precursorintelligence.com/what-is/cve-2013-2423): Oracle JRE Unspecified Vulnerability. Low, CVSS 3.7, chance of use in 30 days 85%, known exploited since 25 May 2022.
- [CVE-2013-0431](https://www.precursorintelligence.com/what-is/cve-2013-0431): Oracle JRE Sandbox Bypass Vulnerability. Low, CVSS 3.7, chance of use in 30 days 90%, known exploited since 25 May 2022.
- [CVE-2022-22947](https://www.precursorintelligence.com/what-is/cve-2022-22947): VMware Spring Cloud Gateway Code Injection Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 98%, known exploited since 16 May 2022.
- [CVE-2021-3156](https://www.precursorintelligence.com/what-is/cve-2021-3156): Sudo Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days >99%, known exploited since 6 April 2022.
- [CVE-2022-22965](https://www.precursorintelligence.com/what-is/cve-2022-22965): Spring Framework JDK 9+ Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 4 April 2022.
- [CVE-2012-5076](https://www.precursorintelligence.com/what-is/cve-2012-5076): Oracle Java SE Sandbox Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 91%, known exploited since 28 March 2022.
- [CVE-2013-2465](https://www.precursorintelligence.com/what-is/cve-2013-2465): Oracle Java SE Unspecified Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 99%, known exploited since 28 March 2022.
- [CVE-2012-0518](https://www.precursorintelligence.com/what-is/cve-2012-0518): Oracle Fusion Middleware Unspecified Vulnerability. Medium, CVSS 4.7, chance of use in 30 days 4.7%, known exploited since 28 March 2022.
- [CVE-2018-1273](https://www.precursorintelligence.com/what-is/cve-2018-1273): VMware Tanzu Spring Data Commons Property Binder Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 25 March 2022.
- [CVE-2013-2251](https://www.precursorintelligence.com/what-is/cve-2013-2251): Apache Struts Improper Input Validation Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 March 2022.
- [CVE-2017-12617](https://www.precursorintelligence.com/what-is/cve-2017-12617): Apache Tomcat Remote Code Execution Vulnerability. High, CVSS 8.1, chance of use in 30 days >99%, known exploited since 25 March 2022.
- [CVE-2019-2616](https://www.precursorintelligence.com/what-is/cve-2019-2616): Oracle BI Publisher Unauthorized Access Vulnerability. High, CVSS 7.2, chance of use in 30 days 92%, known exploited since 25 March 2022.
- [CVE-2012-4681](https://www.precursorintelligence.com/what-is/cve-2012-4681): Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 99%, known exploited since 3 March 2022.
- [CVE-2020-1938](https://www.precursorintelligence.com/what-is/cve-2020-1938): Apache Tomcat Improper Privilege Management Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 March 2022.
- [CVE-2015-2590](https://www.precursorintelligence.com/what-is/cve-2015-2590): Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 25%, known exploited since 3 March 2022.
- [CVE-2012-0507](https://www.precursorintelligence.com/what-is/cve-2012-0507): Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 3 March 2022.
- [CVE-2012-1723](https://www.precursorintelligence.com/what-is/cve-2012-1723): Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 94%, known exploited since 3 March 2022.
- [CVE-2011-3544](https://www.precursorintelligence.com/what-is/cve-2011-3544): Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 3 March 2022.
- [CVE-2011-0611](https://www.precursorintelligence.com/what-is/cve-2011-0611): Adobe Flash Player Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days >99%, known exploited since 3 March 2022.
- [CVE-2008-3431](https://www.precursorintelligence.com/what-is/cve-2008-3431): Oracle VirtualBox Insufficient Input Validation Vulnerability. High, CVSS 8.8, chance of use in 30 days 6.9%, known exploited since 3 March 2022.
- [CVE-2008-2992](https://www.precursorintelligence.com/what-is/cve-2008-2992): Adobe Reader and Acrobat Input Validation Vulnerability. High, CVSS 7.8, chance of use in 30 days 98%, known exploited since 3 March 2022.
- [CVE-2015-4902](https://www.precursorintelligence.com/what-is/cve-2015-4902): Oracle Java SE Integrity Check Vulnerability. Medium, CVSS 5.3, chance of use in 30 days 14%, known exploited since 3 March 2022.
- [CVE-2017-9841](https://www.precursorintelligence.com/what-is/cve-2017-9841): PHPUnit Command Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 15 February 2022.
- [CVE-2017-10271](https://www.precursorintelligence.com/what-is/cve-2017-10271): Oracle Corporation WebLogic Server Remote Code Execution Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 10 February 2022.
- [CVE-2014-6271](https://www.precursorintelligence.com/what-is/cve-2014-6271): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022.
- [CVE-2014-7169](https://www.precursorintelligence.com/what-is/cve-2014-7169): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022.
- [CVE-2020-14864](https://www.precursorintelligence.com/what-is/cve-2020-14864): Oracle Business Intelligence Enterprise Edition Path Transversal. High, CVSS 7.5, chance of use in 30 days 97%, known exploited since 18 January 2022.
- [CVE-2019-2725](https://www.precursorintelligence.com/what-is/cve-2019-2725): Oracle WebLogic Server, Injection. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 10 January 2022.
- [CVE-2017-17562](https://www.precursorintelligence.com/what-is/cve-2017-17562): Embedthis GoAhead Remote Code Execution Vulnerability. High, CVSS 8.1, chance of use in 30 days 96%, known exploited since 10 December 2021.
- [CVE-2021-40438](https://www.precursorintelligence.com/what-is/cve-2021-40438): Apache HTTP Server-Side Request Forgery (SSRF). Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 1 December 2021.
- [CVE-2020-14871](https://www.precursorintelligence.com/what-is/cve-2020-14871): Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 80%, known exploited since 3 November 2021.
- [CVE-2021-42013](https://www.precursorintelligence.com/what-is/cve-2021-42013): Apache HTTP Server Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2020-17530](https://www.precursorintelligence.com/what-is/cve-2020-17530): Apache Struts Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 96%, known exploited since 3 November 2021.
- [CVE-2020-2555](https://www.precursorintelligence.com/what-is/cve-2020-2555): Oracle Multiple Products Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 3 November 2021.
- [CVE-2020-14750](https://www.precursorintelligence.com/what-is/cve-2020-14750): Oracle WebLogic Server Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2020-14882](https://www.precursorintelligence.com/what-is/cve-2020-14882): Oracle WebLogic Server Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2015-4852](https://www.precursorintelligence.com/what-is/cve-2015-4852): Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 3 November 2021.
- [CVE-2017-5638](https://www.precursorintelligence.com/what-is/cve-2017-5638): Apache Struts Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2012-3152](https://www.precursorintelligence.com/what-is/cve-2012-3152): Oracle Fusion Middleware Unspecified Vulnerability. Critical, CVSS 9.1, chance of use in 30 days 99%, known exploited since 3 November 2021.
- [CVE-2018-11776](https://www.precursorintelligence.com/what-is/cve-2018-11776): Apache Struts Remote Code Execution Vulnerability. High, CVSS 8.1, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2019-0211](https://www.precursorintelligence.com/what-is/cve-2019-0211): Apache HTTP Server Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 65%, known exploited since 3 November 2021.
- [CVE-2019-17558](https://www.precursorintelligence.com/what-is/cve-2019-17558): Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability. High, CVSS 7.5, chance of use in 30 days 99%, known exploited since 3 November 2021.
- [CVE-2021-41773](https://www.precursorintelligence.com/what-is/cve-2021-41773): Apache HTTP Server Path Traversal Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2020-14883](https://www.precursorintelligence.com/what-is/cve-2020-14883): Oracle WebLogic Server Unspecified Vulnerability. High, CVSS 7.2, chance of use in 30 days 98%, known exploited since 3 November 2021.
- [CVE-2016-3715](https://www.precursorintelligence.com/what-is/cve-2016-3715): ImageMagick Arbitrary File Deletion Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 75%, known exploited since 3 November 2021.
- [CVE-2016-3718](https://www.precursorintelligence.com/what-is/cve-2016-3718): ImageMagick Server-Side Request Forgery (SSRF) Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 76%, known exploited since 3 November 2021.
- [CVE-2020-1472](https://www.precursorintelligence.com/what-is/cve-2020-1472): Microsoft Netlogon Privilege Escalation Vulnerability. Medium, CVSS 5.5, chance of use in 30 days >99%, known exploited since 3 November 2021.

## Which Oracle flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2008-2992](https://www.precursorintelligence.com/what-is/cve-2008-2992): 98%, High (CVSS 7.8), known exploited
- [CVE-2007-0882](https://www.precursorintelligence.com/what-is/cve-2007-0882): 98%, Critical (CVSS 10.0)
- [CVE-2010-0840](https://www.precursorintelligence.com/what-is/cve-2010-0840): 96%, Critical (CVSS 9.8), known exploited
- [CVE-2002-0840](https://www.precursorintelligence.com/what-is/cve-2002-0840): 95%, Medium (CVSS 6.8)
- [CVE-2008-0226](https://www.precursorintelligence.com/what-is/cve-2008-0226): 92%, High (CVSS 7.5)
- [CVE-2002-0656](https://www.precursorintelligence.com/what-is/cve-2002-0656): 90%, High (CVSS 7.5)
- [CVE-2001-0499](https://www.precursorintelligence.com/what-is/cve-2001-0499): 85%, Critical (CVSS 10.0)
- [CVE-2008-3257](https://www.precursorintelligence.com/what-is/cve-2008-3257): 84%, Critical (CVSS 10.0)
- [CVE-2004-0230](https://www.precursorintelligence.com/what-is/cve-2004-0230): 80%, Medium (CVSS 5.0)
- [CVE-2003-0780](https://www.precursorintelligence.com/what-is/cve-2003-0780): 78%, Critical (CVSS 9.0)

## All Oracle products we track

884 products with at least one tracked version, most vulnerabilities first (the top 150 here; every product is on the page):

- [MySQL](https://www.precursorintelligence.com/product/oracle/mysql): 1,297 vulnerabilities, 676 versions
- [JRE](https://www.precursorintelligence.com/product/oracle/jre): 778 vulnerabilities, 144 versions
- [JDK](https://www.precursorintelligence.com/product/oracle/jdk): 770 vulnerabilities, 114 versions
- [Solaris](https://www.precursorintelligence.com/product/oracle/solaris): 749 vulnerabilities, 13 versions
- [Database Server](https://www.precursorintelligence.com/product/oracle/database_server): 507 vulnerabilities, 137 versions
- [VM Virtualbox](https://www.precursorintelligence.com/product/oracle/vm_virtualbox): 385 vulnerabilities, 274 versions
- [Peoplesoft Enterprise Peopletools](https://www.precursorintelligence.com/product/oracle/peoplesoft_enterprise_peopletools): 345 vulnerabilities, 25 versions
- [E-Business Suite](https://www.precursorintelligence.com/product/oracle/e-business_suite): 327 vulnerabilities, 61 versions
- [Fusion Middleware](https://www.precursorintelligence.com/product/oracle/fusion_middleware): 311 vulnerabilities, 124 versions
- [Weblogic Server](https://www.precursorintelligence.com/product/oracle/weblogic_server): 299 vulnerabilities, 48 versions
- [Mysql Server](https://www.precursorintelligence.com/product/oracle/mysql_server): 229 vulnerabilities, 59 versions
- [Linux](https://www.precursorintelligence.com/product/oracle/linux): 226 vulnerabilities, 13 versions
- [Application Server](https://www.precursorintelligence.com/product/oracle/application_server): 199 vulnerabilities, 78 versions
- [Outside in Technology](https://www.precursorintelligence.com/product/oracle/outside_in_technology): 195 vulnerabilities, 12 versions
- [Graalvm](https://www.precursorintelligence.com/product/oracle/graalvm): 164 vulnerabilities, 71 versions
- [Peoplesoft Products](https://www.precursorintelligence.com/product/oracle/peoplesoft_products): 158 vulnerabilities, 17 versions
- [Jd Edwards Enterpriseone Tools](https://www.precursorintelligence.com/product/oracle/jd_edwards_enterpriseone_tools): 148 vulnerabilities, 24 versions
- [Retail Xstore Point of Service](https://www.precursorintelligence.com/product/oracle/retail_xstore_point_of_service): 125 vulnerabilities, 52 versions
- [Communications Cloud Native Core Policy](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_policy): 125 vulnerabilities, 11 versions
- [Enterprise Manager Base Platform](https://www.precursorintelligence.com/product/oracle/enterprise_manager_base_platform): 119 vulnerabilities, 18 versions
- [Zfs Storage Appliance Kit](https://www.precursorintelligence.com/product/oracle/zfs_storage_appliance_kit): 117 vulnerabilities, 1 version
- [Jrockit](https://www.precursorintelligence.com/product/oracle/jrockit): 107 vulnerabilities, 63 versions
- [Enterprise Manager Ops Center](https://www.precursorintelligence.com/product/oracle/enterprise_manager_ops_center): 107 vulnerabilities, 14 versions
- [HTTP Server](https://www.precursorintelligence.com/product/oracle/http_server): 102 vulnerabilities, 42 versions
- [Openjdk](https://www.precursorintelligence.com/product/oracle/openjdk): 99 vulnerabilities, 59 versions
- [Supply Chain Products Suite](https://www.precursorintelligence.com/product/oracle/supply_chain_products_suite): 96 vulnerabilities, 55 versions
- [Primavera Unifier](https://www.precursorintelligence.com/product/oracle/primavera_unifier): 95 vulnerabilities, 43 versions
- [Flexcube Universal Banking](https://www.precursorintelligence.com/product/oracle/flexcube_universal_banking): 94 vulnerabilities, 24 versions
- [Webcenter Portal](https://www.precursorintelligence.com/product/oracle/webcenter_portal): 90 vulnerabilities, 4 versions
- [Enterprise Manager Grid Control](https://www.precursorintelligence.com/product/oracle/enterprise_manager_grid_control): 84 vulnerabilities, 25 versions
- [Financial Services Analytical Applications Infrastructure](https://www.precursorintelligence.com/product/oracle/financial_services_analytical_applications_infrastructure): 83 vulnerabilities, 70 versions
- [Business Intelligence](https://www.precursorintelligence.com/product/oracle/business_intelligence): 81 vulnerabilities, 14 versions
- [Communications Diameter Signaling Router](https://www.precursorintelligence.com/product/oracle/communications_diameter_signaling_router): 80 vulnerabilities, 16 versions
- [Siebel CRM](https://www.precursorintelligence.com/product/oracle/siebel_crm): 78 vulnerabilities, 16 versions
- [Peoplesoft Enterprise](https://www.precursorintelligence.com/product/oracle/peoplesoft_enterprise): 76 vulnerabilities, 78 versions
- [Flexcube Private Banking](https://www.precursorintelligence.com/product/oracle/flexcube_private_banking): 75 vulnerabilities, 16 versions
- [Communications Cloud Native Core Binding Support Function](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_binding_support_function): 75 vulnerabilities, 9 versions
- [Communications Session Route Manager](https://www.precursorintelligence.com/product/oracle/communications_session_route_manager): 74 vulnerabilities, 11 versions
- [Marketing](https://www.precursorintelligence.com/product/oracle/marketing): 73 vulnerabilities, 14 versions
- [Communications Unified Inventory Management](https://www.precursorintelligence.com/product/oracle/communications_unified_inventory_management): 72 vulnerabilities, 10 versions
- [Banking Platform](https://www.precursorintelligence.com/product/oracle/banking_platform): 72 vulnerabilities, 13 versions
- [Application Testing Suite](https://www.precursorintelligence.com/product/oracle/application_testing_suite): 71 vulnerabilities, 10 versions
- [Agile Plm](https://www.precursorintelligence.com/product/oracle/agile_plm): 70 vulnerabilities, 4 versions
- [Communications Session Report Manager](https://www.precursorintelligence.com/product/oracle/communications_session_report_manager): 69 vulnerabilities, 10 versions
- [Communications Element Manager](https://www.precursorintelligence.com/product/oracle/communications_element_manager): 68 vulnerabilities, 9 versions
- [Database](https://www.precursorintelligence.com/product/oracle/database): 66 vulnerabilities, 14 versions
- [Communications Billing and Revenue Management](https://www.precursorintelligence.com/product/oracle/communications_billing_and_revenue_management): 66 vulnerabilities, 10 versions
- [Javafx](https://www.precursorintelligence.com/product/oracle/javafx): 64 vulnerabilities, 21 versions
- [Collaboration Suite](https://www.precursorintelligence.com/product/oracle/collaboration_suite): 63 vulnerabilities, 7 versions
- [Primavera Gateway](https://www.precursorintelligence.com/product/oracle/primavera_gateway): 59 vulnerabilities, 40 versions
- [Instantis Enterprisetrack](https://www.precursorintelligence.com/product/oracle/instantis_enterprisetrack): 58 vulnerabilities, 3 versions
- [Primavera P6 Enterprise Project Portfolio Management](https://www.precursorintelligence.com/product/oracle/primavera_p6_enterprise_project_portfolio_management): 58 vulnerabilities, 101 versions
- [Mysql Enterprise Monitor](https://www.precursorintelligence.com/product/oracle/mysql_enterprise_monitor): 58 vulnerabilities, 83 versions
- [Communications Instant Messaging Server](https://www.precursorintelligence.com/product/oracle/communications_instant_messaging_server): 57 vulnerabilities, 10 versions
- [Retail Customer Management and Segmentation Foundation](https://www.precursorintelligence.com/product/oracle/retail_customer_management_and_segmentation_foundation): 57 vulnerabilities, 8 versions
- [Agile Product Lifecycle Management](https://www.precursorintelligence.com/product/oracle/agile_product_lifecycle_management): 56 vulnerabilities, 7 versions
- [Retail Merchandising System](https://www.precursorintelligence.com/product/oracle/retail_merchandising_system): 56 vulnerabilities, 9 versions
- [Advanced Outbound Telephony](https://www.precursorintelligence.com/product/oracle/advanced_outbound_telephony): 55 vulnerabilities, 10 versions
- [Siebel UI Framework](https://www.precursorintelligence.com/product/oracle/siebel_ui_framework): 53 vulnerabilities, 28 versions
- [Webcenter Sites](https://www.precursorintelligence.com/product/oracle/webcenter_sites): 53 vulnerabilities, 11 versions
- [Commerce Guided Search](https://www.precursorintelligence.com/product/oracle/commerce_guided_search): 52 vulnerabilities, 12 versions
- [Oracle9i](https://www.precursorintelligence.com/product/oracle/oracle9i): 52 vulnerabilities, 67 versions
- [Berkeley DB](https://www.precursorintelligence.com/product/oracle/berkeley_db): 51 vulnerabilities, 80 versions
- [Communications Cloud Native Core Automated Test Suite](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_automated_test_suite): 50 vulnerabilities, 3 versions
- [Communications Policy Management](https://www.precursorintelligence.com/product/oracle/communications_policy_management): 50 vulnerabilities, 63 versions
- [Financial Services Software](https://www.precursorintelligence.com/product/oracle/financial_services_software): 48 vulnerabilities, 25 versions
- [One-to-One Fulfillment](https://www.precursorintelligence.com/product/oracle/one-to-one_fulfillment): 47 vulnerabilities, 11 versions
- [Oracle8i](https://www.precursorintelligence.com/product/oracle/oracle8i): 46 vulnerabilities, 59 versions
- [Communications Cloud Native Core Network Function Cloud Native Environment](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_network_function_cloud_native_environment): 46 vulnerabilities, 7 versions
- [Communications Operations Monitor](https://www.precursorintelligence.com/product/oracle/communications_operations_monitor): 45 vulnerabilities, 9 versions
- [Application Express](https://www.precursorintelligence.com/product/oracle/application_express): 45 vulnerabilities, 29 versions
- [Retail Service Backbone](https://www.precursorintelligence.com/product/oracle/retail_service_backbone): 45 vulnerabilities, 19 versions
- [Communications Services Gatekeeper](https://www.precursorintelligence.com/product/oracle/communications_services_gatekeeper): 45 vulnerabilities, 4 versions
- [Mysql Cluster](https://www.precursorintelligence.com/product/oracle/mysql_cluster): 44 vulnerabilities, 115 versions
- [Peoplesoft and Jdedwards Product Suite](https://www.precursorintelligence.com/product/oracle/peoplesoft_and_jdedwards_product_suite): 44 vulnerabilities, 22 versions
- [Flexcube Investor Servicing](https://www.precursorintelligence.com/product/oracle/flexcube_investor_servicing): 44 vulnerabilities, 18 versions
- [Jd Edwards Enterpriseone Orchestrator](https://www.precursorintelligence.com/product/oracle/jd_edwards_enterpriseone_orchestrator): 43 vulnerabilities, 9 versions
- [Mysql Workbench](https://www.precursorintelligence.com/product/oracle/mysql_workbench): 42 vulnerabilities, 23 versions
- [Communications Cloud Native Core Unified Data Repository](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_unified_data_repository): 42 vulnerabilities, 6 versions
- [Communications Pricing Design Center](https://www.precursorintelligence.com/product/oracle/communications_pricing_design_center): 41 vulnerabilities, 7 versions
- [Communications Messaging Server](https://www.precursorintelligence.com/product/oracle/communications_messaging_server): 41 vulnerabilities, 7 versions
- [Glassfish Server](https://www.precursorintelligence.com/product/oracle/glassfish_server): 41 vulnerabilities, 14 versions
- [Blockchain Platform](https://www.precursorintelligence.com/product/oracle/blockchain_platform): 40 vulnerabilities, 1 version
- [Istore](https://www.precursorintelligence.com/product/oracle/istore): 40 vulnerabilities, 13 versions
- [Retail Order Broker](https://www.precursorintelligence.com/product/oracle/retail_order_broker): 39 vulnerabilities, 8 versions
- [Retail Integration Bus](https://www.precursorintelligence.com/product/oracle/retail_integration_bus): 39 vulnerabilities, 32 versions
- [Communications Evolved Communications Application Server](https://www.precursorintelligence.com/product/oracle/communications_evolved_communications_application_server): 39 vulnerabilities, 1 version
- [Graalvm for JDK](https://www.precursorintelligence.com/product/oracle/graalvm_for_jdk): 39 vulnerabilities, 30 versions
- [Banking Virtual Account Management](https://www.precursorintelligence.com/product/oracle/banking_virtual_account_management): 39 vulnerabilities, 9 versions
- [Communications Network Charging and Control](https://www.precursorintelligence.com/product/oracle/communications_network_charging_and_control): 39 vulnerabilities, 7 versions
- [Business Intelligence Publisher](https://www.precursorintelligence.com/product/oracle/business_intelligence_publisher): 38 vulnerabilities, 11 versions
- [VM Server](https://www.precursorintelligence.com/product/oracle/vm_server): 38 vulnerabilities, 6 versions
- [Database 10g](https://www.precursorintelligence.com/product/oracle/database_10g): 37 vulnerabilities, 6 versions
- [Sun Products Suite](https://www.precursorintelligence.com/product/oracle/sun_products_suite): 37 vulnerabilities, 29 versions
- [Communications Offline Mediation Controller](https://www.precursorintelligence.com/product/oracle/communications_offline_mediation_controller): 37 vulnerabilities, 4 versions
- [Jd Edwards Enterpriseone](https://www.precursorintelligence.com/product/oracle/jd_edwards_enterpriseone): 37 vulnerabilities, 16 versions
- [Utilities Framework](https://www.precursorintelligence.com/product/oracle/utilities_framework): 37 vulnerabilities, 23 versions
- [Data Integrator](https://www.precursorintelligence.com/product/oracle/data_integrator): 36 vulnerabilities, 8 versions
- [Hospitality Simphony](https://www.precursorintelligence.com/product/oracle/hospitality_simphony): 36 vulnerabilities, 17 versions
- [Bi Publisher](https://www.precursorintelligence.com/product/oracle/bi_publisher): 35 vulnerabilities, 10 versions
- [Banking Payments](https://www.precursorintelligence.com/product/oracle/banking_payments): 35 vulnerabilities, 11 versions
- [Hyperion Infrastructure Technology](https://www.precursorintelligence.com/product/oracle/hyperion_infrastructure_technology): 34 vulnerabilities, 5 versions
- [Insurance Rules Palette](https://www.precursorintelligence.com/product/oracle/insurance_rules_palette): 34 vulnerabilities, 24 versions
- [Hospitality Guest Access](https://www.precursorintelligence.com/product/oracle/hospitality_guest_access): 34 vulnerabilities, 4 versions
- [Sun Zfs Storage Appliance Kit](https://www.precursorintelligence.com/product/oracle/sun_zfs_storage_appliance_kit): 33 vulnerabilities, 12 versions
- [Retail Predictive Application Server](https://www.precursorintelligence.com/product/oracle/retail_predictive_application_server): 33 vulnerabilities, 50 versions
- [Secure Global Desktop](https://www.precursorintelligence.com/product/oracle/secure_global_desktop): 33 vulnerabilities, 11 versions
- [Enterprise Manager](https://www.precursorintelligence.com/product/oracle/enterprise_manager): 33 vulnerabilities, 43 versions
- [Goldengate Application Adapters](https://www.precursorintelligence.com/product/oracle/goldengate_application_adapters): 33 vulnerabilities, 3 versions
- [Application Object Library](https://www.precursorintelligence.com/product/oracle/application_object_library): 33 vulnerabilities, 13 versions
- [Commerce Platform](https://www.precursorintelligence.com/product/oracle/commerce_platform): 32 vulnerabilities, 18 versions
- [Bea Product Suite](https://www.precursorintelligence.com/product/oracle/bea_product_suite): 32 vulnerabilities, 22 versions
- [Autovue for Agile Product Lifecycle Management](https://www.precursorintelligence.com/product/oracle/autovue_for_agile_product_lifecycle_management): 32 vulnerabilities, 1 version
- [Banking Digital Experience](https://www.precursorintelligence.com/product/oracle/banking_digital_experience): 31 vulnerabilities, 8 versions
- [Trade Management](https://www.precursorintelligence.com/product/oracle/trade_management): 31 vulnerabilities, 12 versions
- [Communications Cloud Native Core Network Exposure Function](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_network_exposure_function): 31 vulnerabilities, 2 versions
- [Insurance Policy Administration](https://www.precursorintelligence.com/product/oracle/insurance_policy_administration): 31 vulnerabilities, 12 versions
- [Business Process Management Suite](https://www.precursorintelligence.com/product/oracle/business_process_management_suite): 30 vulnerabilities, 6 versions
- [Agile Engineering Data Management](https://www.precursorintelligence.com/product/oracle/agile_engineering_data_management): 30 vulnerabilities, 7 versions
- [Secure Backup](https://www.precursorintelligence.com/product/oracle/secure_backup): 30 vulnerabilities, 15 versions
- [Hospitality Reporting and Analytics](https://www.precursorintelligence.com/product/oracle/hospitality_reporting_and_analytics): 30 vulnerabilities, 5 versions
- [Enterprise Manager Database Control](https://www.precursorintelligence.com/product/oracle/enterprise_manager_database_control): 30 vulnerabilities, 8 versions
- [Communications Cloud Native Core Network Slice Selection Function](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_network_slice_selection_function): 30 vulnerabilities, 5 versions
- [Communications Billing and Revenue Management Elastic Charging Engine](https://www.precursorintelligence.com/product/oracle/communications_billing_and_revenue_management_elastic_charging_engine): 30 vulnerabilities, 7 versions
- [Banking Treasury Management](https://www.precursorintelligence.com/product/oracle/banking_treasury_management): 29 vulnerabilities, 3 versions
- [Business Activity Monitoring](https://www.precursorintelligence.com/product/oracle/business_activity_monitoring): 29 vulnerabilities, 3 versions
- [Timesten in-Memory Database](https://www.precursorintelligence.com/product/oracle/timesten_in-memory_database): 28 vulnerabilities, 9 versions
- [Enterprise Communications Broker](https://www.precursorintelligence.com/product/oracle/enterprise_communications_broker): 28 vulnerabilities, 12 versions
- [Banking Credit Facilities Process Management](https://www.precursorintelligence.com/product/oracle/banking_credit_facilities_process_management): 27 vulnerabilities, 8 versions
- [Banking Corporate Lending Process Management](https://www.precursorintelligence.com/product/oracle/banking_corporate_lending_process_management): 27 vulnerabilities, 8 versions
- [Transportation Management](https://www.precursorintelligence.com/product/oracle/transportation_management): 27 vulnerabilities, 22 versions
- [Utilities Testing Accelerator](https://www.precursorintelligence.com/product/oracle/utilities_testing_accelerator): 27 vulnerabilities, 3 versions
- [CRM Technical Foundation](https://www.precursorintelligence.com/product/oracle/crm_technical_foundation): 27 vulnerabilities, 13 versions
- [Opensolaris](https://www.precursorintelligence.com/product/oracle/opensolaris): 27 vulnerabilities, 9 versions
- [Customer Relationship Management Technical Foundation](https://www.precursorintelligence.com/product/oracle/customer_relationship_management_technical_foundation): 27 vulnerabilities, 12 versions
- [Communications Cloud Native Core Service Communication Proxy](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_service_communication_proxy): 26 vulnerabilities, 4 versions
- [Banking Supply Chain Finance](https://www.precursorintelligence.com/product/oracle/banking_supply_chain_finance): 26 vulnerabilities, 6 versions
- [Communications Cloud Native Core Security Edge Protection Proxy](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_security_edge_protection_proxy): 26 vulnerabilities, 6 versions
- [Global Lifecycle Management Opatch](https://www.precursorintelligence.com/product/oracle/global_lifecycle_management_opatch): 25 vulnerabilities, 7 versions
- [Jdeveloper](https://www.precursorintelligence.com/product/oracle/jdeveloper): 25 vulnerabilities, 16 versions
- [Applications Framework](https://www.precursorintelligence.com/product/oracle/applications_framework): 25 vulnerabilities, 15 versions
- [SD-WAN Edge](https://www.precursorintelligence.com/product/oracle/sd-wan_edge): 25 vulnerabilities, 6 versions
- [Database 9i](https://www.precursorintelligence.com/product/oracle/database_9i): 25 vulnerabilities, 5 versions
- [Hospitality Suite8](https://www.precursorintelligence.com/product/oracle/hospitality_suite8): 24 vulnerabilities, 46 versions
- [Banking Corporate Lending](https://www.precursorintelligence.com/product/oracle/banking_corporate_lending): 24 vulnerabilities, 8 versions
- [Communications Network Integrity](https://www.precursorintelligence.com/product/oracle/communications_network_integrity): 24 vulnerabilities, 3 versions
- [Complex Maintenance Repair and Overhaul](https://www.precursorintelligence.com/product/oracle/complex_maintenance_repair_and_overhaul): 24 vulnerabilities, 9 versions
- [Banking Enterprise Default Management](https://www.precursorintelligence.com/product/oracle/banking_enterprise_default_management): 23 vulnerabilities, 7 versions
- [Rest Data Services](https://www.precursorintelligence.com/product/oracle/rest_data_services): 23 vulnerabilities, 12 versions
- [Communications Cloud Native Core Network Repository Function](https://www.precursorintelligence.com/product/oracle/communications_cloud_native_core_network_repository_function): 23 vulnerabilities, 6 versions

## Questions

### How many vulnerabilities does Oracle have?

Our catalogue lists 10,095 published vulnerabilities across 1,089 products and 8,654 versions from Oracle. The most recent Oracle flaw added to the known-exploited list is CVE-2016-3081, on 8 October 2026.

### Which Oracle vulnerabilities are being exploited?

81 Oracle vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2016-3081, CVE-2024-21182 and CVE-2025-61757. The full list is on this page.

### Which Oracle product has the most vulnerabilities?

MySQL, with 1,297 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Oracle vulnerabilities?

Create a Precursor Intelligence account and track the Oracle products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Oracle?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact