Login Request a demo
WS
Product
Webcenter Sites
by Oracle · last CVE Aug 18, 2026
On CISA KEVExploited in the wild
90
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities90In the news0Timeline
Severity mix
Critical 23High 43Medium 20Low 2
Severity
All severities90Critical23High43Medium20Low2
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Webcenter Sites to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-3602
8.1
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3554
8.1
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2016-3487
8.1
5%
Jul 21
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity,…
Affected: 11.1.1.8; 12.2.1.0
CVE-2026-46796
8.0
0%
Jun 16
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2020-5258
7.7
4%
Mar 10
Prototype pollution in dojo
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2017-3596
7.6
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2026-61007
7.5
0%
Aug 18
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60554
7.5
0%
Jul 21
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-35295
7.5
0%
Jun 16
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2020-7226
7.5
3%
Jan 24
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-5427
7.5
5%
Apr 22
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2018-15756
7.5
9%
Oct 18
DoS Attack via Range Requests
Affected: 12.2.1.3.0
CVE-2020-2739
7.4
2%
Apr 15
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI)
Affected: 12.2.1.3.0
CVE-2020-2538
7.1
1%
Jan 15
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI)
Affected: 12.2.1.3.0
CVE-2017-3595
7.1
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3593
7.1
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3591
7.1
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2018-3238
6.9
5%
Oct 17
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0
CVE-2026-60557
6.5
0%
Jul 21
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2021-26272
6.5
2%
Jan 26
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2021-26271
6.5
2%
Jan 26
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2016-3502
6.5
1%
Jul 21
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8 and 12.2.1.0 allows remote authenticated users to affect confidentiality,…
Affected: 11.1.1.8; 12.2.1.0
CVE-2024-20908
6.1
0%
Jan 16
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI)
Affected: 12.2.1.4.0
CVE-2020-14613
6.1
1%
Jul 15
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced User Interface)
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-2539
6.1
1%
Jan 15
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI)
Affected: 12.2.1.3.0
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 11.1.1.8.0
CVE-2017-3594
5.9
1%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3597
5.7
2%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2021-27906
5.5
3%
Mar 19
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2021-27807
5.5
3%
Mar 19
A carefully crafted PDF file can trigger an infinite loop while loading the file
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-12415
5.5
1%
Oct 23
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2021-32808
5.4
1%
Aug 12
ckeditor is an open source WYSIWYG HTML editor with rich content support
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2579
4.3
6%
Apr 23
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 12.2.1.3.0
CVE-2018-2584
4.3
1%
Jan 18
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0
CVE-2016-5511
4.3
2%
Oct 25
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0 allows remote attackers to affect integrity…
Affected: 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-10033
4.0
2%
Oct 19
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools)
Affected: 11.1.1.8.0; 12.2.1.2.0
CVE-2017-3603
3.1
1%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3598
3.1
1%
Apr 24
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI)
Affected: 11.1.1.8.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2014-0107
–
14%
Apr 15
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote…
Affected: 7.6.2; 11.1.1.8.0
CVE-2013-4316
–
8%
Sep 30
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors
Affected: 11.1.1.6.1; 11.1.1.8.0
Page 2 of 2 · 90 total
12