Login Request a demo
WS
App Server
WebLogic Server
by Oracle · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
359
CVEs
16
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities359In the news5Timeline
Severity mix
Critical 107High 112Medium 124Low 4
Severity
All severities359Critical107High112Medium124Low4
Exploitation
On CISA KEV16Exploited in the wild16
Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-30762
7.5
0%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0
CVE-2025-21549
7.5
1%
Jan 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 14.1.1.0.0
CVE-2024-21274
7.5
1%
Oct 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0 through 14.1.1.0.0
CVE-2024-21260
7.5
1%
Oct 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2024-21234
7.5
1%
Oct 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2024-21183
7.5
0%
Jul 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2024-21007
7.5
1%
Apr 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2024-21006
7.5
8%
Apr 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2024-20931
7.5
60%
Feb 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2023-22108
7.5
1%
Oct 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2023-22086
7.5
1%
Oct 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21996
7.5
1%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21979
7.5
1%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21964
7.5
1%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21931
7.5
82%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21842
7.5
1%
Jan 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21841
7.5
1%
Jan 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21838
7.5
1%
Jan 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21837
7.5
1%
Jan 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21441
7.5
1%
Apr 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-24839
7.5
2%
Apr 11
org.cyberneko.html is an html parser written in Java
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-36518
7.5
5%
Mar 11
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21371
7.5
93%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21292
7.5
2%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-4104
7.5
81%
Dec 14
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-35620
7.5
1%
Oct 20
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-40690
7.5
7%
Sep 19
Bypass of the secureValidation property
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2378
7.5
2%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2376
7.5
2%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2157
7.5
2%
Apr 22
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-28491
7.5
3%
Feb 18
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14820
7.5
4%
Oct 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2967
7.5
2%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14639
7.5
2%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14589
7.5
2%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2828
7.5
2%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services)
Affected: 10.3.6.0.0
CVE-2020-7226
7.5
3%
Jan 24
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because…
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2020-5398
7.5
88%
Jan 16
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-17359
7.5
9%
Oct 8
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2650
7.5
39%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2649
7.5
37%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2648
7.5
2%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2647
7.5
2%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2018-15756
7.5
9%
Oct 18
DoS Attack via Range Requests
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2018-3246
7.5
3%
Oct 17
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 12.1.3.0.0; 12.2.1.3; 12.2.1.3.0
CVE-2018-3213
7.5
4%
Oct 17
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Docker Images)
Affected: before 12.2.1.3.0
CVE-2018-11040
7.5
3%
Jun 25
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON…
Affected: 12.2.1.3.0
CVE-2018-1000180
7.5
3%
Jun 5
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in…
Affected: 12.1.3.0.0
CVE-2016-8610
7.5
40%
Nov 13
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2021-3450
7.4
18%
Mar 25
CA certificate check bypass with X509_V_FLAG_X509_STRICT
Affected: 12.2.1.4.0; 14.1.1.0.0
Page 2 of 3 · 112 total
123