Skip to main content
EVULNABLE
Home

Oracle

CVEs currently on EVULNABLE's Priority Feed for Oracle, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 1 added.

Week of 2026-04-20: 0 added to KEV Week of 2026-04-27: 0 added to KEV Week of 2026-05-04: 0 added to KEV Week of 2026-05-11: 0 added to KEV Week of 2026-05-18: 0 added to KEV Week of 2026-05-25: 0 added to KEV Week of 2026-06-01: 1 added to KEV Week of 2026-06-08: 1 ransomware-linked of 1 added to KEV Week of 2026-06-15: 0 added to KEV Week of 2026-06-22: 0 added to KEV Week of 2026-06-29: 0 added to KEV Week of 2026-07-06: 0 added to KEV Week of 2026-07-13: 1 added to KEV Week of 2026-07-20: 0 added to KEV Week of 2026-07-27: 0 added to KEV Week of 2026-08-03: 0 added to KEV Week of 2026-08-10: 0 added to KEV Week of 2026-08-17: 0 added to KEV Week of 2026-08-24: 1 added to KEV Week of 2026-08-31: 0 added to KEV Week of 2026-09-07: 0 added to KEV Week of 2026-09-14: 0 added to KEV Week of 2026-09-21: 0 added to KEV Week of 2026-09-28: 0 added to KEV Week of 2026-10-05: 0 added to KEV Week of 2026-10-12 (so far): 0 added to KEV
1
0
May
Jun
Jul
Aug
Sep
Oct
  • Not ransomware-linked
  • Ransomware-linked
  • This week (so far)
CISA KEV additions per week, last 26 weeks
Week ofAdded to KEVRansomware-linked
2026-04-2000
2026-04-2700
2026-05-0400
2026-05-1100
2026-05-1800
2026-05-2500
2026-06-0110
2026-06-0811
2026-06-1500
2026-06-2200
2026-06-2900
2026-07-0600
2026-07-1310
2026-07-2000
2026-07-2700
2026-08-0300
2026-08-1000
2026-08-1700
2026-08-2410
2026-08-3100
2026-09-0700
2026-09-1400
2026-09-2100
2026-09-2800
2026-10-0500
2026-10-12 (so far)00

In EVULNABLE's ranked feed

Showing all 46 Oracle CVEs in EVULNABLE's ranked feed.

#1 96 Immediate CVE-2026-35273 ExigentCISA federal deadline · Overdue by 4 monthsRansomwareCISA KEV Oracle — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability KEV + ransomware, EPSS 96.7%

EVRS 96/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.7% · 99.89th pctlKEV since2026-06-12

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#2 95 Immediate CVE-2025-61882 ExigentKEV since 2025 · listed over a yearRansomwareCISA KEV Oracle — Oracle E-Business Suite Unspecified Vulnerability KEV + ransomware, EPSS 99.7%

EVRS 95/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.7% · 99.95th pctlKEV since2025-10-06

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#3 94 Immediate CVE-2019-2725 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle WebLogic Server, Injection KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.98th pctlKEV since2022-01-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#4 93 Immediate CVE-2013-2465 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Java SE Unspecified Vulnerability KEV + ransomware, EPSS 98.8%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.8% · 99.93rd pctlKEV since2022-03-28

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#5 93 Immediate CVE-2012-4681 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability KEV + ransomware, EPSS 98.5%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.5% · 99.92nd pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#6 93 Immediate CVE-2022-21587 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Oracle — Oracle E-Business Suite Unspecified Vulnerability KEV + ransomware, EPSS 98.3%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.3% · 99.92nd pctlKEV since2023-02-02

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#7 93 Immediate CVE-2012-0507 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability KEV + ransomware, EPSS 98.2%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.2% · 99.91st pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#8 93 Immediate CVE-2013-0422 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle JRE Remote Code Execution Vulnerability KEV + ransomware, EPSS 97.0%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS97.0% · 99.89th pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#9 92 Immediate CVE-2025-61884 CISA federal deadline · Overdue by 11 monthsRansomwareCISA KEV Oracle — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability KEV + ransomware, EPSS 95.9%

EVRS 92/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS95.9% · 99.87th pctlKEV since2025-10-20

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#10 92 Immediate CVE-2012-1723 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability KEV + ransomware, EPSS 93.7%

EVRS 92/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS93.7% · 99.84th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#11 91 Immediate CVE-2017-10271 KEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 91/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS99.9% · 99.99th pctlKEV since2022-02-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#12 87 Immediate CVE-2020-14882 ExigentKEV since 2021 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Remote Code Execution Vulnerability KEV, EPSS 99.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗
#13 87 Immediate CVE-2018-2628 ExigentKEV since 2022 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Unspecified Vulnerability KEV, EPSS 99.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.98th pctlKEV since2022-09-08

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#14 87 Immediate CVE-2020-14750 ExigentKEV since 2021 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Remote Code Execution Vulnerability KEV, EPSS 99.2%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.2% · 99.94th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.992.

Full CVE pageNVD ↗CISA KEV ↗
#15 87 Immediate CVE-2020-2883 ExigentKEV since 2025 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Unspecified Vulnerability KEV, EPSS 94.6%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS94.6% · 99.86th pctlKEV since2025-01-07

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.946.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#16 87 Immediate CVE-2025-61757 CISA federal deadline · Overdue by 10 monthsCISA KEV Oracle — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability KEV, EPSS 88.6%

EVRS 87/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS88.6% · 99.78th pctlKEV since2025-11-21

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.886.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#17 86 Immediate CVE-2012-3152 ExigentKEV since 2021 · listed over a yearCISA KEV Oracle — Oracle Fusion Middleware Unspecified Vulnerability KEV, EPSS 98.8%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.1 (NVD)EPSS98.8% · 99.93rd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.988.

Full CVE pageNVD ↗CISA KEV ↗
#18 86 Immediate CVE-2020-2555 ExigentKEV since 2021 · listed over a yearCISA KEV Oracle — Oracle Multiple Products Remote Code Execution Vulnerability KEV, EPSS 97.1%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS97.1% · 99.89th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.971.

Full CVE pageNVD ↗CISA KEV ↗
#19 86 Immediate CVE-2011-3544 ExigentKEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability KEV, EPSS 96.7%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.7% · 99.89th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.967.

Full CVE pageNVD ↗CISA KEV ↗
#20 86 Immediate CVE-2010-0840 ExigentKEV since 2022 · listed over a yearCISA KEV Oracle — Oracle JRE Unspecified Vulnerability KEV, EPSS 96.3%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.3% · 99.88th pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.963.

Full CVE pageNVD ↗CISA KEV ↗
#21 86 Immediate CVE-2021-35587 ExigentKEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Fusion Middleware Unspecified Vulnerability KEV, EPSS 96.3%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.3% · 99.88th pctlKEV since2022-11-28

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.963.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#22 86 Immediate CVE-2015-4852 ExigentKEV since 2021 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability KEV, EPSS 95.0%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS95.0% · 99.86th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.950.

Full CVE pageNVD ↗CISA KEV ↗
#23 86 Immediate CVE-2020-14644 ExigentKEV since 2024 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Remote Code Execution Vulnerability KEV, EPSS 94.5%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS94.5% · 99.86th pctlKEV since2024-09-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.945.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#24 85 Immediate CVE-2020-2551 ExigentKEV since 2023 · listed over a yearCISA KEV Oracle — Oracle Fusion Middleware Unspecified Vulnerability KEV, EPSS 92.8%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS92.8% · 99.83rd pctlKEV since2023-11-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.928.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#25 85 Immediate CVE-2016-3427 ExigentKEV since 2023 · listed over a yearCISA KEV Oracle — Oracle Java SE and JRockit Unspecified Vulnerability KEV, EPSS 92.3%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS92.3% · 99.82nd pctlKEV since2023-05-12

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.923.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#26 85 Immediate CVE-2012-5076 ExigentKEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Java SE Sandbox Bypass Vulnerability KEV, EPSS 91.2%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS91.2% · 99.81st pctlKEV since2022-03-28

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.912.

Full CVE pageNVD ↗CISA KEV ↗
#27 85 Immediate CVE-2013-0431 KEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle JRE Sandbox Bypass Vulnerability KEV + ransomware, EPSS 90.1%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.3 (NVD)EPSS90.1% · 99.8th pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#28 85 Immediate CVE-2026-21962 CISA federal deadline · Overdue by 50 daysCISA KEV Oracle — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability KEV, EPSS 73.2%, added to KEV within the last 90 days

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS10.0 (NVD)EPSS73.2% · 99.45th pctlKEV since2026-08-24

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.732.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#29 85 Immediate CVE-2012-1710 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Oracle — Oracle Fusion Middleware Unspecified Vulnerability KEV + ransomware, EPSS 7.8%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS7.8% · 94.6th pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#30 84 Urgent CVE-2023-21839 KEV since 2023 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Unspecified Vulnerability KEV, EPSS 99.9%

EVRS 84/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS99.9% · 99.97th pctlKEV since2023-05-01

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#31 83 Urgent CVE-2020-14883 KEV since 2021 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server Unspecified Vulnerability KEV, EPSS 97.7%

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.2 (NVD)EPSS97.7% · 99.91st pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.977.

Full CVE pageNVD ↗CISA KEV ↗
#32 83 Urgent CVE-2020-14864 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Business Intelligence Enterprise Edition Path Transversal KEV, EPSS 97.2%

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS97.2% · 99.9th pctlKEV since2022-01-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.972.

Full CVE pageNVD ↗CISA KEV ↗
#33 83 Urgent CVE-2017-3506 KEV since 2024 · listed over a yearCISA KEV Oracle — Oracle WebLogic Server OS Command Injection Vulnerability KEV, EPSS 96.0%

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.4 (NVD)EPSS96.0% · 99.88th pctlKEV since2024-06-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.960.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#34 82 Urgent CVE-2019-2616 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle BI Publisher Unauthorized Access Vulnerability KEV, EPSS 92.2%

EVRS 82/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.2 (NVD)EPSS92.2% · 99.82nd pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.922.

Full CVE pageNVD ↗CISA KEV ↗
#35 82 Urgent CVE-2020-14871 KEV since 2021 · listed over a yearCISA KEV Oracle — Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability KEV, EPSS 80.2%

EVRS 82/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS10.0 (NVD)EPSS80.2% · 99.61st pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.802.

Full CVE pageNVD ↗CISA KEV ↗
#36 80 Urgent CVE-2024-21182 CISA federal deadline · Overdue by 4 monthsCISA KEV Oracle — Oracle WebLogic Server Unspecified Vulnerability KEV, EPSS 74.2%

EVRS 80/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS74.2% · 99.48th pctlKEV since2026-06-01

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.742.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#37 77 Urgent CVE-2022-21445 KEV since 2024 · listed over a yearCISA KEV Oracle — Oracle ADF Faces Deserialization of Untrusted Data Vulnerability KEV, EPSS 62.5%

EVRS 77/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS62.5% · 99.18th pctlKEV since2024-09-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.625.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#38 75 Urgent CVE-2013-2423 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle JRE Unspecified Vulnerability KEV, EPSS 85.2%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS3.7 (NVD)EPSS85.2% · 99.72nd pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.852.

Full CVE pageNVD ↗CISA KEV ↗
#39 75 Urgent CVE-2015-2590 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability KEV, EPSS 25.5%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS25.5% · 97.9th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.255.

Full CVE pageNVD ↗CISA KEV ↗
#40 75 Urgent CVE-2015-4902 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Java SE Integrity Check Vulnerability KEV, EPSS 13.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.3 (NVD)EPSS13.6% · 96.4th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.136.

Full CVE pageNVD ↗CISA KEV ↗
#41 75 Urgent CVE-2019-3010 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Solaris Privilege Escalation Vulnerability KEV, EPSS 13.4%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS13.4% · 96.4th pctlKEV since2022-05-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.134.

Full CVE pageNVD ↗CISA KEV ↗
#42 75 Urgent CVE-2008-3431 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle VirtualBox Insufficient Input Validation Vulnerability KEV, EPSS 6.9%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS6.9% · 94th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.069.

Full CVE pageNVD ↗CISA KEV ↗
#43 75 Urgent CVE-2012-0518 KEV since 2022 · listed over a yearCISA KEV Oracle — Oracle Fusion Middleware Unspecified Vulnerability KEV, EPSS 4.7%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS4.7 (NVD)EPSS4.7% · 91.7th pctlKEV since2022-03-28

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.047.

Full CVE pageNVD ↗CISA KEV ↗
#44 75 Urgent CVE-2024-20953 KEV since 2025 · listed over a yearCISA KEV Oracle — Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability KEV, EPSS 3.9%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS3.9% · 90.2nd pctlKEV since2025-02-24

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.039.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#45 75 Urgent CVE-2024-21287 KEV since 2024 · listed over a yearCISA KEV Oracle — Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability KEV, EPSS 1.7%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS1.7% · 77.1st pctlKEV since2024-11-21

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.017.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#46 75 Urgent CVE-2026-46817 CISA federal deadline · Overdue by 3 monthsCISA KEV Oracle — Oracle E-Business Suite Improper Privilege Management Vulnerability KEV, EPSS 0.8%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS0.8% · 56.2nd pctlKEV since2026-07-15

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.008.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗