Login Request a demo
EM
Product
Enterprise Manager Base Platform
by Oracle · last CVE Aug 18, 2026
On CISA KEVExploited in the wild
161
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities161In the news0Timeline
Severity mix
Critical 26High 68Medium 66Low 1
Severity
All severities161Critical26High68Medium66Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Enterprise Manager Base Platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-11776
In wildKEV
8.1
100%
Aug 22
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
Affected: 13.3.0.0; 13.4.0.0
CVE-2026-46855
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46854
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Target Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46852
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46832
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46994
9.8
1%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46857
9.8
1%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2022-23305
9.8
67%
Jan 18
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
Affected: 13.4.0.0; 13.5.0.0
CVE-2020-11973
9.8
7%
May 14
Apache Camel Netty enables Java deserialization by default
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-11972
9.8
6%
May 14
Apache Camel RabbitMQ enables Java deserialization by default
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10683
9.8
7%
May 1
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
Affected: 13.4.0.0
CVE-2020-2961
9.8
2%
Apr 15
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS))
Affected: 13.2.0.0; 13.3.0.0
CVE-2020-9546
9.8
5%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-9547
9.8
18%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-9548
9.8
19%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka…
Affected: 13.3.0.0; 13.4.0.0
CVE-2019-20330
9.8
9%
Jan 3
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking
Affected: 13.3.0.0; 13.4.0.0
CVE-2019-12419
9.8
14%
Nov 6
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service
Affected: 13.2.1.0
CVE-2019-17195
9.8
11%
Oct 15
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…
Affected: 13.4.0.0
CVE-2019-13990
9.8
17%
Jul 26
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description
Affected: 13.2.1.0
CVE-2018-1000613
9.8
5%
Jul 9
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select…
Affected: 12.1.0.5.0; 13.2.0.0; 13.3.0.0
CVE-2017-5645
9.8
89%
Apr 17
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…
Affected: 12.1.0.5; 13.2.0.0
CVE-2026-46856
9.6
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46853
9.6
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46989
9.1
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46875
9.1
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-34279
9.1
0%
Apr 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46872
9.0
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-61284
8.8
0%
Aug 18
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-47004
8.8
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46998
8.8
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46995
8.8
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46992
8.8
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46864
8.8
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2024-21067
8.8
0%
Apr 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management)
Affected: 13.5.0.0
CVE-2022-21392
8.8
1%
Jan 19
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework)
Affected: 13.4.0.0; 13.5.0.0
CVE-2022-23307
8.8
54%
Jan 18
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
Affected: 13.4.0.0; 13.5.0.0
CVE-2022-23302
8.8
64%
Jan 18
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
Affected: 13.4.0.0; 13.5.0.0
CVE-2021-2137
8.8
1%
Oct 20
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework)
Affected: 13.4.0.0; 13.5.0.0
CVE-2021-3518
8.8
22%
May 18
There's a flaw in libxml2 in versions before 2.9.11
Affected: 13.4.0.0; 13.5.0.0
CVE-2020-11113
8.8
6%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-11112
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-11111
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10969
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10968
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10673
8.8
8%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10672
8.8
3%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2019-5064
8.8
11%
Jan 3
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0
Affected: 13.4.0.0
CVE-2019-5063
8.8
21%
Jan 3
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0
Affected: 13.4.0.0
CVE-2026-61286
8.6
0%
Aug 18
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2021-3517
8.6
17%
May 19
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11
Affected: 13.4.0.0; 13.5.0.0
Page 1 of 4 · 161 total
12…4