DS
Product
Database Server
530
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 24Medium 47Low 32
Watch
Add Database Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1953 | 10.0 | Mar 13 | Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements Affected: 11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c |
| CVE-2026-61211 | 9.9 | Jul 21 | Vulnerability in the RDBMS component of Oracle Database Server Affected: 19.3 through 19.31; 23.4 through 23.26.2 |
| CVE-2018-3110 | 9.9 | Aug 10 | A vulnerability was discovered in the Java VM component of Oracle Database Server Affected: 11.2.0.4; 12.1.0.2; 12.2.0.1; 18 |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 12.2.0.1; 18c; 19c |
| CVE-2018-14719 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c |
| CVE-2018-3259 | 9.8 | Oct 17 | Vulnerability in the Java VM component of Oracle Database Server Affected: 11.2.0.4; 12.1.0.2; 12.2.0.1; 18c |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 12.2.0.1; 18.1 |
| CVE-2016-9843 | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation Affected: 18c |
| CVE-2016-9841 | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: 18c |
| CVE-2004-1363 | 9.8 | Aug 4 | Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check… Affected: 8.1.7.4; 9.0.1.4; 9.0.1.5; 9.0.4; 9.2.0.4; 9.2.0.5; +1 more |
| CVE-2026-71064 | 9.6 | Aug 18 | Vulnerability in the Portable Clusterware component of Oracle Database Server Affected: 19.3 through 19.32; 21.3 through 21.23; 23.4.0 through 23.26.3 |
| CVE-2026-71063 | 9.6 | Aug 18 | Vulnerability in the Portable Clusterware component of Oracle Database Server Affected: 19.3 through 19.32; 21.3 through 21.23; 23.4.0 through 23.26.3 |
| CVE-2026-71102 | 9.1 | Aug 18 | Vulnerability in the Portable Clusterware component of Oracle Database Server Affected: 19.3 through 19.32; 21.3 through 21.23; 23.4.0 through 23.26.3 |
| CVE-2026-47040 | 9.1 | Jul 21 | Vulnerability in the Oracle Net Services component of Oracle Database Server Affected: 19.3 through 19.31; 21.3 through 21.22; 23.4 through 23.26.2 |
| CVE-2019-2517 | 9.1 | Apr 23 | Vulnerability in the Core RDBMS component of Oracle Database Server Affected: 12.2.0.1; 18c |
| CVE-2017-10282 | 9.1 | Jan 18 | Vulnerability in the Core RDBMS component of Oracle Database Server Affected: 12.1.0.2; 12.2.0.1 |
| CVE-2016-5555 | 9.1 | Oct 25 | Unspecified vulnerability in the OJVM component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote administrators to affect confidentiality, integrity, and availability… Affected: 11.2.0.4; 12.1.0.2 |
| CVE-2026-46833 | 9.0 | May 28 | Vulnerability in the Net Service component of Oracle Database Server Affected: 23.4.0 through 23.26.2 |
Showing 18
The 500 most important CVEs for this product (exploited first, then by severity)