Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
46 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-21962 | Oracle | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | Severity: Critical CVSS 10.0 | Aug 24, 2026 | Not known |
| CVE-2026-46817 | Oracle | Oracle E-Business Suite Improper Privilege Management Vulnerability | Severity: Critical CVSS 9.8 | Jul 15, 2026 | Not known |
| CVE-2026-35273 | Oracle | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Severity: Critical CVSS 9.8 | Jun 12, 2026 | Known |
| CVE-2024-21182 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: High CVSS 7.5 | Jun 1, 2026 | Not known |
| CVE-2025-61757 | Oracle | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | Severity: Critical CVSS 9.8 | Nov 21, 2025 | Not known |
| CVE-2025-61884 | Oracle | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | Severity: High CVSS 7.5 | Oct 20, 2025 | Known |
| CVE-2025-61882 | Oracle | Oracle E-Business Suite Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Oct 6, 2025 | Known |
| CVE-2024-20953 | Oracle | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | Severity: High CVSS 8.8 | Feb 24, 2025 | Not known |
| CVE-2020-2883 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Jan 7, 2025 | Not known |
| CVE-2024-21287 | Oracle | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | Severity: High CVSS 7.5 | Nov 21, 2024 | Not known |
| CVE-2020-14644 | Oracle | Oracle WebLogic Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Sep 18, 2024 | Not known |
| CVE-2022-21445 | Oracle | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Sep 18, 2024 | Not known |
| CVE-2017-3506 | Oracle | Oracle WebLogic Server OS Command Injection Vulnerability | Severity: High CVSS 7.4 | Jun 3, 2024 | Not known |
| CVE-2020-2551 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Nov 16, 2023 | Not known |
| CVE-2016-3427 | Oracle | Oracle Java SE and JRockit Unspecified Vulnerability | Severity: Critical CVSS 9.8 | May 12, 2023 | Not known |
| CVE-2023-21839 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: High CVSS 7.5 | May 1, 2023 | Not known |
| CVE-2022-21587 | Oracle | Oracle E-Business Suite Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Feb 2, 2023 | Known |
| CVE-2021-35587 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Nov 28, 2022 | Not known |
| CVE-2018-2628 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Sep 8, 2022 | Not known |
| CVE-2010-0840 | Oracle | Oracle JRE Unspecified Vulnerability | Severity: Critical CVSS 9.8 | May 25, 2022 | Not known |
| CVE-2012-1710 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Critical CVSS 9.8 | May 25, 2022 | Known |
| CVE-2013-0422 | Oracle | Oracle JRE Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | May 25, 2022 | Known |
| CVE-2019-3010 | Oracle | Oracle Solaris Privilege Escalation Vulnerability | Severity: High CVSS 8.8 | May 25, 2022 | Not known |
| CVE-2013-0431 | Oracle | Oracle JRE Sandbox Bypass Vulnerability | Severity: Elevated CVSS 5.3 | May 25, 2022 | Known |
| CVE-2013-2423 | Oracle | Oracle JRE Unspecified Vulnerability | Severity: Informational CVSS 3.7 | May 25, 2022 | Not known |
| CVE-2012-5076 | Oracle | Oracle Java SE Sandbox Bypass Vulnerability | Severity: Critical CVSS 9.8 | Mar 28, 2022 | Not known |
| CVE-2013-2465 | Oracle | Oracle Java SE Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Mar 28, 2022 | Known |
| CVE-2012-0518 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Elevated CVSS 4.7 | Mar 28, 2022 | Not known |
| CVE-2019-2616 | Oracle | Oracle BI Publisher Unauthorized Access Vulnerability | Severity: High CVSS 7.2 | Mar 25, 2022 | Not known |
| CVE-2011-3544 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2012-0507 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2012-1723 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2012-4681 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2015-2590 | Oracle | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2008-3431 | Oracle | Oracle VirtualBox Insufficient Input Validation Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2015-4902 | Oracle | Oracle Java SE Integrity Check Vulnerability | Severity: Elevated CVSS 5.3 | Mar 3, 2022 | Not known |
| CVE-2017-10271 | Oracle | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | Severity: High CVSS 7.5 | Feb 10, 2022 | Known |
| CVE-2020-14864 | Oracle | Oracle Business Intelligence Enterprise Edition Path Transversal | Severity: High CVSS 7.5 | Jan 18, 2022 | Not known |
| CVE-2019-2725 | Oracle | Oracle WebLogic Server, Injection | Severity: Critical CVSS 9.8 | Jan 10, 2022 | Known |
| CVE-2020-14871 | Oracle | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.