Login Request a demo
JD
Product
Jdeveloper
by Oracle · last CVE Jul 21, 2026
On CISA KEVExploited in the wild
35
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities35In the news0Timeline
Severity mix
Critical 9High 9Medium 9Low 4
Severity
All severities35Critical9High9Medium9Low4
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Jdeveloper to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-21445
In wildKEV
9.8
62%
Apr 19
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2018-14721
10.0
10%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…
Affected: 12.1.3.0.0; 12.2.1.3.0
CVE-2022-23305
9.8
67%
Jan 18
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
Affected: 12.2.1.3.0
CVE-2020-10683
9.8
7%
May 1
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
Affected: 12.2.1.4.0
CVE-2018-14718
9.8
13%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…
Affected: 12.1.3.0.0; 12.2.1.3.0
CVE-2018-14719
9.8
10%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…
Affected: 12.1.3.0.0; 12.2.1.3.0
CVE-2018-14720
9.8
8%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from…
Affected: 12.1.3.0.0; 12.2.1.3.0
CVE-2017-5645
9.8
89%
Apr 17
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…
Affected: 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2016-3504
9.8
3%
Jul 21
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to…
Affected: 11.1.1.7.0; 11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2022-23307
8.8
54%
Jan 18
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
Affected: 12.2.1.3.0
CVE-2022-23302
8.8
64%
Jan 18
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
Affected: 12.2.1.3.0
CVE-2018-2711
8.2
1%
Jan 18
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework)
Affected: 11.1.1.2.4; 11.1.1.7.0; 11.1.1.7.1; 11.1.1.9.0; 12.1.3.0.0
CVE-2026-60629
7.5
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60622
7.5
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2021-4104
7.5
81%
Dec 14
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration
Affected: 12.2.1.3.0
CVE-2019-12402
7.5
16%
Aug 30
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs
Affected: 12.2.1.4.0
CVE-2026-60345
7.2
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-61061
7.0
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60350
6.5
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2020-11022
6.1
99%
Apr 29
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e
Affected: 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0; 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2026-60349
5.9
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60348
5.9
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2017-3255
5.8
2%
Jan 27
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: ADF Faces)
Affected: 11.1.1.7.0; 11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0; +1 more
CVE-2019-12415
5.5
1%
Oct 23
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files…
Affected: 12.2.1.4.0
CVE-2026-60351
4.8
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2017-10273
4.7
1%
Jan 18
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment)
Affected: 11.1.1.7.0; 11.1.1.7.1; 11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.2.0
CVE-2026-60354
3.7
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60352
3.7
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60353
3.1
0%
Jul 21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2019-2899
2.4
1%
Oct 16
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM)
Affected: 11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2008-2623
–
0%
Jan 14
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.3 allows local users to affect confidentiality via unknown vectors
Affected: 10.1.2.3
CVE-2008-2588
–
0%
Oct 14
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 allows local users to affect confidentiality via unknown vectors
Affected: 10.1.2.2
CVE-2005-2292
–
1%
Jul 18
Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain…
Affected: 9.0.4; 9.0.5; 10.1.2
CVE-2005-2291
–
1%
Jul 18
Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to gain sensitive information
Affected: 9.0.4; 9.0.5; 10.1.2
Showing 35