Oracle

CPE vendor key: oracle · 3,415 CVEs published in the last 24 months.

CVEs (365 d)

3,156

▼ -1,524 vs prior 30d

Avg CVSS (365 d)

7.58

over 3,156 CVEs

Avg EPSS pct (365 d)

0.26

higher = more likely exploited

KEV hit rate (365 d)

0.1%

4 of 3,156 added to CISA KEV

LLM-credited CVEs

none detected

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

e-business_suite

172

hyperion_financial_management

162

mysql_server

145

coherence

112

helidon

110

vm_virtualbox

109

webcenter_content

109

commerce_guided_search

siebel_crm

commerce_experience_manager

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

2,138

471

387

210

193

157

Distinct CVEs assigned each weakness.

Recent CISA KEV adds (last 12 months)

Added	CVE	Product	KEV name
2026-08-24	CVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
2026-07-15	CVE-2026-46817	E-Business Suite	Oracle E-Business Suite Improper Privilege Management Vulnerability
2026-06-12	CVE-2026-35273	PeopleSoft Enterprise PeopleTools	Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
2026-06-01	CVE-2024-21182	WebLogic Server	Oracle WebLogic Server Unspecified Vulnerability
2025-11-21	CVE-2025-61757	Fusion Middleware	Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Filtered to KEV entries whose CISA vendor or product name matches this vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps that CPE-map to Microsoft).

Known exploited, all time (85)

Published	CVE
2026-06-11	CVE-2026-35273
2026-05-28	CVE-2026-46817
2026-01-20	CVE-2026-21962
2025-10-21	CVE-2025-61757
2025-10-12	CVE-2025-61884
2025-10-05	CVE-2025-61882
2024-11-18	CVE-2024-21287
2024-07-16	CVE-2024-21182
2024-02-17	CVE-2024-20953
2023-09-21	CVE-2023-41993
2023-01-18	CVE-2023-21839
2022-10-18	CVE-2022-21587
2022-04-19	CVE-2022-21445
2022-04-01	CVE-2022-22963
2022-04-01	CVE-2022-22965
2022-03-03	CVE-2022-22947
2022-01-28	CVE-2021-4034
2022-01-19	CVE-2021-35587
2021-10-07	CVE-2021-42013
2021-10-05	CVE-2021-41773
2021-09-16	CVE-2021-40438
2021-08-23	CVE-2021-39144
2021-01-26	CVE-2021-3156
2020-12-11	CVE-2020-17530
2020-11-02	CVE-2020-14750
2020-10-21	CVE-2020-14864
2020-10-21	CVE-2020-14871
2020-10-21	CVE-2020-14882
2020-10-21	CVE-2020-14883
2020-08-17	CVE-2020-1472
2020-07-15	CVE-2020-14644
2020-04-29	CVE-2020-11023
2020-04-15	CVE-2020-2883
2020-02-24	CVE-2020-1938
2020-01-15	CVE-2020-2551
2020-01-15	CVE-2020-2555
2019-12-30	CVE-2019-17558
2019-10-16	CVE-2019-3010
2019-04-26	CVE-2019-2725
2019-04-23	CVE-2019-2616
2019-04-08	CVE-2019-0211
2018-08-22	CVE-2018-11776
2018-04-19	CVE-2018-2628
2018-04-11	CVE-2018-1273
2018-01-29	CVE-2017-1000353
2017-12-12	CVE-2017-17562
2017-10-19	CVE-2017-10271
2017-10-04	CVE-2017-12617
2017-06-27	CVE-2017-9841
2017-04-24	CVE-2017-3506
2017-04-06	CVE-2016-8735
2017-03-11	CVE-2017-5638
2016-05-05	CVE-2016-3715
2016-05-05	CVE-2016-3718
2016-04-26	CVE-2016-3081
2016-04-21	CVE-2016-3427
2015-12-07	CVE-2015-5287
2015-11-18	CVE-2015-4852
2015-10-22	CVE-2015-4902
2015-08-08	CVE-2015-4495

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

Generated 16 October 2026 14:24 UTC .