Login Request a demo
UF
Product
Utilities Framework
by Oracle · last CVE Jan 20, 2026
On CISA KEVExploited in the wild
35
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities35In the news0Timeline
Severity mix
Critical 6High 20Medium 8Low 1
Severity
All severities35Critical6High20Medium8Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Utilities Framework to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-2555
In wildKEV
9.8
97%
Jan 15
Oracle Multiple Products Remote Code Execution Vulnerability
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2021-39144
In wildKEV
8.5
98%
Aug 23
XStream is vulnerable to a Remote Command Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2020-14756
9.8
75%
Jan 20
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components)
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-10683
9.8
7%
May 1
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
Affected: 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2019-17495
9.8
6%
Oct 10
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input…
Affected: 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2019-10173
9.8
95%
Jul 23
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw
Affected: 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0
CVE-2018-8088
9.8
15%
Mar 20
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.2.0; 4.3.0.3.0; 4.3.0.4.0; 4.3.0.5.0; +2 more
CVE-2021-39139
8.8
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39150
8.5
3%
Aug 23
A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39152
8.5
11%
Aug 23
A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39149
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39148
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39147
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39146
8.5
14%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39145
8.5
4%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39141
8.5
16%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39153
8.5
4%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39151
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39154
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2020-28052
8.1
7%
Dec 18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66
Affected: 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-36518
7.5
5%
Mar 11
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0; 4.4.0.5.0
CVE-2021-31684
7.5
2%
Jun 1
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request
Affected: 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-25649
7.5
18%
Dec 3
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-11979
7.5
8%
Oct 1
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2018-1000632
7.5
7%
Aug 20
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element
Affected: 4.3.0.2.0 through 4.3.0.6.0; 2.2.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2
CVE-2019-10086
7.3
29%
Aug 20
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2021-39140
6.3
6%
Aug 23
XStream can cause a Denial of Service
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2020-1945
6.3
2%
May 14
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak…
Affected: 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 4.3.0.1 through 4.3.0.4
CVE-2021-27568
5.9
3%
Feb 23
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4
Affected: 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2021-36374
5.5
3%
Jul 14
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even…
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2021-36373
5.5
3%
Jul 14
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small…
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2026-21924
5.4
0%
Jan 20
Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General)
Affected: 4.3.0.3.0; 4.5.0.0.0; 4.5.0.1.1; 4.5.0.1.3; 4.5.0.2.0; 25.4; +1 more
CVE-2020-14895
5.4
1%
Oct 21
Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: System Wide)
Affected: 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2020-9488
3.7
8%
Apr 27
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Affected: 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0
Showing 35