Login Request a demo
WS
App Server
WebLogic Server
by Oracle · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
359
CVEs
16
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities359In the news5Timeline
Severity mix
Critical 107High 112Medium 124Low 4
Severity
All severities359Critical107High112Medium124Low4
Exploitation
On CISA KEV16Exploited in the wild16
Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-14572
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11022
6.1
99%
Apr 29
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0; 10.3.6.0.0; +4 more
CVE-2020-2811
6.1
1%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2889
6.1
1%
Oct 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.2.1.3.0
CVE-2018-3250
6.1
2%
Oct 17
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0
CVE-2018-2987
6.1
1%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 12.1.3.0; 12.2.1.3
CVE-2017-10178
6.1
1%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2016-7103
6.1
29%
Mar 15
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2016-3416
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-0700
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0
CVE-2016-0675
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0
CVE-2026-101515
5.9
0%
Oct 20
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2021-2211
5.9
2%
Apr 22
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 10.3.6.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-27568
5.9
3%
Feb 23
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2018-11039
5.9
3%
Jun 25
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2018-10237
5.9
5%
Apr 26
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this…
Affected: 12.2.1.3.0
CVE-2017-10148
5.8
3%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2022-21557
5.7
0%
Jul 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21960
5.6
0%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-12400
5.5
1%
Aug 23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2019-2827
5.5
1%
Jul 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2824
5.5
1%
Jul 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2618
5.5
33%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2018-11771
5.5
5%
Aug 16
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after…
Affected: 14.1.1.0.0
CVE-2018-1324
5.5
4%
Mar 16
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes…
Affected: 14.1.1.0.0
CVE-2020-2966
5.4
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2395
5.4
1%
Jan 16
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0
CVE-2018-2998
5.4
1%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: SAML)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2016-0696
5.4
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors…
Affected: 10.3.6.0.0
CVE-2025-61764
5.3
0%
Oct 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0
CVE-2022-21564
5.3
1%
Jul 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21560
5.3
1%
Jul 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-35552
5.3
1%
Oct 20
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Diagnostics)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2403
5.3
2%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-28170
5.3
2%
May 26
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid
Affected: 14.1.1.0.0
CVE-2021-2204
5.3
1%
Apr 22
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-13956
5.3
9%
Dec 2
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick…
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2020-10693
5.3
2%
May 6
A flaw was found in Hibernate Validator version 6.1.2.Final
Affected: 14.1.1.0.0
CVE-2020-2766
5.3
2%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-5397
5.3
3%
Jan 17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2888
5.3
5%
Oct 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2441
5.3
2%
Jan 16
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Application Container - JavaEE)
Affected: 12.2.1.3
CVE-2018-1313
5.3
5%
May 7
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under…
Affected: 12.2.1.3
CVE-2018-2625
5.3
2%
Jan 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)
Affected: 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3.0
CVE-2017-10336
5.3
2%
Oct 19
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2016-5488
5.3
4%
Oct 25
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.3.0 allows remote attackers to affect availability via vectors…
Affected: 10.3.6.0.0; 12.1.3.0.0
CVE-2016-3445
5.3
4%
Jul 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.3.0 allows remote attackers to affect availability via vectors…
Affected: 10.3.6.0.0; 12.1.3.0.0
CVE-2022-21616
5.2
0%
Oct 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2550
5.1
1%
Jan 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
Page 2 of 3 · 124 total
123