AP
Product
Agile Product Lifecycle Management
On CISA KEVExploited in the wildRansomware-linked
151
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 74Medium 61Low 4
Watch
Add Agile Product Lifecycle Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-87252 | 6.8 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server) Affected: 9.3.6 |
| CVE-2017-10039 | 6.8 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client) Affected: 9.3.5; 9.3.6 |
| CVE-2026-61169 | 6.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2026-47009 | 6.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2025-21560 | 6.5 | Jan 21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit) Affected: 9.3.6 |
| CVE-2022-21467 | 6.5 | Apr 19 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments) Affected: 9.3.6 |
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: 9.3.6 |
| CVE-2021-26272 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space… Affected: 9.3.5; 9.3.6 |
| CVE-2021-26271 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the… Affected: 9.3.5; 9.3.6 |
| CVE-2018-1257 | 6.5 | May 11 | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a… Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2016-5521 | 6.5 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3537 | 6.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3431 | 6.4 | Apr 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticated users to affect… Affected: 9.3.1.1; 9.3.1.2; 9.3.2; 9.3.3 |
| CVE-2016-3420 | 6.4 | Apr 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticated users to affect… Affected: 9.3.1.1; 9.3.1.2; 9.3.2; 9.3.3 |
| CVE-2026-87253 | 6.1 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client) Affected: 9.3.6 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 9.3.6 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 9.3.6 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 9.3.6 |
| CVE-2020-27193 | 6.1 | Nov 12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and… Affected: 9.3.5; 9.3.6 |
| CVE-2020-2920 | 6.1 | Apr 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2020-9281 | 6.1 | Mar 7 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted… Affected: 9.3.5; 9.3.6 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 9.3.3; 9.3.6 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 9.3.3 |
| CVE-2018-2609 | 6.1 | Jan 18 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6 |
| CVE-2017-10092 | 6.1 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6 |
| CVE-2017-10082 | 6.1 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6; 9.3.5; 9.3.6 |
| CVE-2017-10080 | 6.1 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6 |
| CVE-2017-10052 | 6.1 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: PCMServlet) Affected: 9.3.5; 9.3.6 |
| CVE-2016-5512 | 6.1 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3557 | 6.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3555 | 6.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3519 | 6.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity… Affected: 9.3.4; 9.3.5 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: 9.3.6 |
| CVE-2021-24122 | 5.9 | Jan 14 | Apache Tomcat information disclosure Affected: 9.3.3; 9.3.6 |
| CVE-2018-11039 | 5.9 | Jun 25 | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any… Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2016-5527 | 5.9 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via unknown… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3529 | 5.8 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via vectors… Affected: 9.3.4; 9.3.5 |
| CVE-2021-3572 | 5.7 | Nov 10 | A flaw was found in python-pip in the way it handled Unicode separators in git references Affected: 9.3.6 |
| CVE-2021-36374 | 5.5 | Jul 14 | When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even… Affected: 9.3.6 |
| CVE-2021-36373 | 5.5 | Jul 14 | When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small… Affected: 9.3.6 |
| CVE-2020-17521 | 5.5 | Dec 7 | Apache Groovy provides extension methods to aid with creating temporary directories Affected: 9.3.3; 9.3.6 |
| CVE-2023-22039 | 5.4 | Jul 18 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: WebClient) Affected: 9.3.6 |
| CVE-2021-41165 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 9.3.6 |
| CVE-2021-41164 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 9.3.6 |
| CVE-2019-2817 | 5.4 | Jul 23 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Folders, Files & Attachments) Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2017-10094 | 5.4 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6 |
| CVE-2016-3553 | 5.4 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3509 | 5.4 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality and… Affected: 9.3.4; 9.3.5 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 9.3.6 |
| CVE-2017-10093 | 5.3 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) Affected: 9.3.5; 9.3.6 |