AP
Product
Agile Product Lifecycle Management
On CISA KEVExploited in the wildRansomware-linked
151
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 74Medium 61Low 4
Watch
Add Agile Product Lifecycle Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2020-35490 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 9.3.6 |
| CVE-2020-14195 | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 9.3.6 |
| CVE-2020-14060 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 9.3.6 |
| CVE-2020-14061 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 9.3.6 |
| CVE-2020-14062 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 9.3.6 |
| CVE-2026-87257 | 7.7 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK) Affected: 9.3.6 |
| CVE-2026-87256 | 7.7 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server) Affected: 9.3.6 |
| CVE-2026-87258 | 7.6 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2026-87254 | 7.5 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2026-71043 | 7.5 | Aug 18 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2026-61172 | 7.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2025-21565 | 7.5 | Jan 21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install) Affected: 9.3.6 |
| CVE-2021-40690 | 7.5 | Sep 19 | Bypass of the secureValidation property Affected: 9.3.6 |
| CVE-2021-25122 | 7.5 | Mar 1 | Apache Tomcat h2c request mix-up Affected: 9.3.3; 9.3.6 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 9.3.6 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2020-13934 | 7.5 | Jul 14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2 Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 9.3.3 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2018-11040 | 7.5 | Jun 25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON… Affected: 9.3.3; 9.3.4; 9.3.5 |
| CVE-2016-3526 | 7.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via vectors… Affected: 9.3.4; 9.3.5 |
| CVE-2026-61173 | 7.4 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2016-5526 | 7.3 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3561 | 7.3 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3539 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3538 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3530 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2026-71041 | 7.0 | Aug 18 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart) Affected: 9.3.6 |
| CVE-2021-25329 | 7.0 | Mar 1 | Incomplete fix for CVE-2020-9484 Affected: 9.3.3; 9.3.6 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2026-87252 | 6.8 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server) Affected: 9.3.6 |
| CVE-2017-10039 | 6.8 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client) Affected: 9.3.5; 9.3.6 |
| CVE-2026-61169 | 6.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2026-47009 | 6.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2025-21560 | 6.5 | Jan 21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit) Affected: 9.3.6 |
| CVE-2022-21467 | 6.5 | Apr 19 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments) Affected: 9.3.6 |
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: 9.3.6 |
| CVE-2021-26272 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space… Affected: 9.3.5; 9.3.6 |
| CVE-2021-26271 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the… Affected: 9.3.5; 9.3.6 |
| CVE-2018-1257 | 6.5 | May 11 | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a… Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2016-5521 | 6.5 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3537 | 6.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3431 | 6.4 | Apr 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticated users to affect… Affected: 9.3.1.1; 9.3.1.2; 9.3.2; 9.3.3 |
| CVE-2016-3420 | 6.4 | Apr 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticated users to affect… Affected: 9.3.1.1; 9.3.1.2; 9.3.2; 9.3.3 |