Login Request a demo
EM
Product
Enterprise Manager Base Platform
by Oracle · last CVE Aug 18, 2026
On CISA KEVExploited in the wild
161
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities161In the news0Timeline
Severity mix
Critical 26High 68Medium 66Low 1
Severity
All severities161Critical26High68Medium66Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Enterprise Manager Base Platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-46855
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46854
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Target Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46852
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46832
9.9
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46994
9.8
1%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46857
9.8
1%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2022-23305
9.8
67%
Jan 18
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
Affected: 13.4.0.0; 13.5.0.0
CVE-2020-11973
9.8
7%
May 14
Apache Camel Netty enables Java deserialization by default
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-11972
9.8
6%
May 14
Apache Camel RabbitMQ enables Java deserialization by default
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-10683
9.8
7%
May 1
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
Affected: 13.4.0.0
CVE-2020-2961
9.8
2%
Apr 15
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS))
Affected: 13.2.0.0; 13.3.0.0
CVE-2020-9546
9.8
5%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-9547
9.8
18%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 13.3.0.0; 13.4.0.0
CVE-2020-9548
9.8
19%
Mar 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka…
Affected: 13.3.0.0; 13.4.0.0
CVE-2019-20330
9.8
9%
Jan 3
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking
Affected: 13.3.0.0; 13.4.0.0
CVE-2019-12419
9.8
14%
Nov 6
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service
Affected: 13.2.1.0
CVE-2019-17195
9.8
11%
Oct 15
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…
Affected: 13.4.0.0
CVE-2019-13990
9.8
17%
Jul 26
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description
Affected: 13.2.1.0
CVE-2018-1000613
9.8
5%
Jul 9
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select…
Affected: 12.1.0.5.0; 13.2.0.0; 13.3.0.0
CVE-2017-5645
9.8
89%
Apr 17
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…
Affected: 12.1.0.5; 13.2.0.0
CVE-2026-46856
9.6
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46853
9.6
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46989
9.1
0%
Jul 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46875
9.1
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-34279
9.1
0%
Apr 21
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management)
Affected: 13.5.0.0; 24.1.0.0.0
CVE-2026-46872
9.0
0%
Jun 16
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install)
Affected: 13.5.0.0; 24.1.0.0.0
Showing 26