Login Request a demo
UF
Product
Utilities Framework
by Oracle · last CVE Jan 20, 2026
On CISA KEVExploited in the wild
35
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities35In the news0Timeline
Severity mix
Critical 6High 20Medium 8Low 1
Severity
All severities35Critical6High20Medium8Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Utilities Framework to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-39144
In wildKEV
8.5
98%
Aug 23
XStream is vulnerable to a Remote Command Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39139
8.8
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39150
8.5
3%
Aug 23
A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39152
8.5
11%
Aug 23
A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39149
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39148
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39147
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39146
8.5
14%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39145
8.5
4%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39141
8.5
16%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39153
8.5
4%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39151
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2021-39154
8.5
5%
Aug 23
XStream is vulnerable to an Arbitrary Code Execution attack
Affected: 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; +1 more
CVE-2020-28052
8.1
7%
Dec 18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66
Affected: 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-36518
7.5
5%
Mar 11
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0; 4.4.0.5.0
CVE-2021-31684
7.5
2%
Jun 1
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request
Affected: 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-25649
7.5
18%
Dec 3
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
CVE-2020-11979
7.5
8%
Oct 1
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them
Affected: 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0
CVE-2018-1000632
7.5
7%
Aug 20
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element
Affected: 4.3.0.2.0 through 4.3.0.6.0; 2.2.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2
CVE-2019-10086
7.3
29%
Aug 20
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
Affected: 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0
Showing 20