PE
Product
PeopleSoft Enterprise PeopleTools
On CISA KEVExploited in the wildRansomware-linked
428
CVEs
2
On KEV
9.9
Max CVSS
52
New 30D
Severity mix
Critical 18High 110Medium 255Low 17
Watch
Add PeopleSoft Enterprise PeopleTools to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35273 RansomwareIn wildKEV | 9.8 | Jun 11 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Affected: 8.61; 8.62 |
| CVE-2019-2725 RansomwareIn wildKEV | 9.8 | Apr 26 | Oracle WebLogic Server, Injection Affected: 8.56; 8.57; 8.58 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: 8.58; 8.59 |
| CVE-2026-60821 | 9.8 | Aug 18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink) Affected: 8.61 through 8.63 |
| CVE-2022-21543 | 9.8 | Jul 19 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt) Affected: 8.58; 8.59 |
| CVE-2021-3711 | 9.8 | Aug 24 | SM2 Decryption Buffer Overflow Affected: 8.57; 8.58; 8.59 |
| CVE-2021-22931 | 9.8 | Aug 16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name… Affected: 8.57; 8.58; 8.59 |
| CVE-2019-17195 | 9.8 | Oct 15 | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or… Affected: 8.58; 8.59 |
| CVE-2019-2729 | 9.8 | Jun 19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) Affected: 8.56; 8.57; 8.58 |
| CVE-2019-0228 | 9.8 | Apr 17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF Affected: 8.58; 8.59 |
| CVE-2018-1000613 | 9.8 | Jul 9 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select… Affected: 8.55; 8.56; 8.57 |
| CVE-2018-1000120 | 9.8 | Mar 14 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse Affected: 8.55; 8.56; 8.57 |
| CVE-2017-15708 | 9.8 | Dec 11 | In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI) Affected: 8.56; 8.57 |
| CVE-2017-10366 | 9.8 | Oct 19 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor) Affected: 8.54; 8.55; 8.56 |
| CVE-2026-101420 | 9.6 | Oct 20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR) Affected: 8.61 through 8.63 |
| CVE-2021-23926 | 9.1 | Jan 14 | The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input Affected: 8.57; 8.58; 8.59 |
| CVE-2018-1000301 | 9.1 | May 24 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading… Affected: 8.55; 8.56; 8.57 |
| CVE-2018-1000122 | 9.1 | Mar 14 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Affected: 8.55; 8.56; 8.57 |
Showing 18