JE
Product
JD Edwards Enterpriseone Tools
On CISA KEVExploited in the wildRansomware-linked
170
CVEs
2
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 33High 55Medium 68Low 5
Watch
Add JD Edwards Enterpriseone Tools to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-61273 | 8.8 | Aug 18 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security) Affected: 9.2.0.0 through 9.2.26.4 |
| CVE-2026-46903 | 8.8 | Jun 16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security) Affected: 9.2.0.0 through 9.2.26.2 |
| CVE-2025-21515 | 8.8 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: before 9.2.4.2 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.4.2 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: before 9.2.4.2 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: before 9.2.4.2 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: before 9.2.4.2 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: before 9.2.4.2 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.4.2 |
| CVE-2022-21464 | 8.2 | Apr 19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC) Affected: 9.2.0.0 through 9.2.6.3 |
| CVE-2026-61268 | 8.1 | Aug 18 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC) Affected: 9.2.0.0 through 9.2.26.4 |
| CVE-2026-60621 | 8.1 | Jul 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security) Affected: 9.2.26.3 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: through 9.2.5.3 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: through 9.2.5.3 |
| CVE-2020-11620 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: before 9.2.4.2 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.4.2 |
| CVE-2025-21511 | 7.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2025-21510 | 7.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2021-22940 | 7.5 | Aug 16 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior Affected: through 9.2.6.1 |
| CVE-2021-22884 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6” Affected: before 9.2.6.0 |
| CVE-2021-22883 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established Affected: before 9.2.6.0 |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: before 9.2.6.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: before 9.2.5.3 |
| CVE-2020-8277 | 7.5 | Nov 19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1… Affected: before 9.2.6.0 |
| CVE-2019-17566 | 7.5 | Nov 12 | Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes Affected: before 9.2.4.0; 9.2.4.2 |
| CVE-2020-25648 | 7.5 | Oct 20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3 Affected: before 9.2.6.0 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 9.2 |
| CVE-2018-12022 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 9.2 |
| CVE-2018-12023 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 9.2 |
| CVE-2018-15769 | 7.5 | Nov 16 | RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue Affected: 9.2 |
| CVE-2018-11054 | 7.5 | Aug 31 | RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability Affected: 9.2 |
| CVE-2018-2944 | 7.5 | Jul 18 | Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Monitoring and Diagnostics) Affected: 9.2 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 9.2 |
| CVE-2017-3730 | 7.5 | May 4 | In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL… Affected: 9.2 |
| CVE-2022-21542 | 7.4 | Jul 19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime) Affected: through 9.2.6.3 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: before 9.2.6.3 |
| CVE-2021-32066 | 7.4 | Aug 1 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1 Affected: before 9.2.6.1 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: before 9.2.6.0 |