Login Request a demo
WS
App Server
WebLogic Server
by Oracle · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
359
CVEs
16
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities359In the news5Timeline
Severity mix
Critical 107High 112Medium 124Low 4
Severity
All severities359Critical107High112Medium124Low4
Exploitation
On CISA KEV16Exploited in the wild16
Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-1000613
9.8
5%
Jul 9
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select…
Affected: 12.2.1.3
CVE-2017-3248
9.8
97%
Jan 27
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0
CVE-2016-5535
9.8
5%
Oct 25
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows remote attackers to affect…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0
CVE-2016-5531
9.8
5%
Oct 25
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality,…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-3551
9.8
6%
Oct 25
Unspecified vulnerability in the Oracle Web Services component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect…
Affected: 11.1.1.7.0; 11.1.1.9.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-3586
9.8
20%
Jul 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality,…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-3510
9.8
91%
Jul 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality,…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-3499
9.8
9%
Jul 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity,…
Affected: 12.1.3.0.0; 12.2.1.0.0
CVE-2016-0638
9.8
63%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality,…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2026-87302
9.1
0%
Oct 20
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60208
9.1
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-35298
9.1
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2024-21175
9.1
0%
Jul 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-60343
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-60313
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60207
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60203
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-35311
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-35303
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-35299
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-35259
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2022-23307
8.8
54%
Jan 18
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-23302
8.8
64%
Jan 18
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-11113
8.8
6%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11112
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11111
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10969
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10968
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10673
8.8
8%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10672
8.8
3%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2018-1258
8.8
2%
May 11
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security
Affected: 10.3.6.0; 12.1.3.0; 12.2.1.2; 12.2.1.3
CVE-2016-3505
8.8
6%
Oct 25
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2026-35258
8.7
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60699
8.6
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60293
8.6
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2024-20927
8.6
1%
Feb 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2017-10147
8.6
4%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2026-60196
8.4
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-35302
8.3
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2018
8.3
1%
Jan 20
Vulnerability in the Advanced Networking Option component of Oracle Database Server
Affected: 12.2.1.3.0
CVE-2018-2935
8.3
2%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JSF)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2020-11987
8.2
13%
Feb 24
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14588
8.2
2%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2867
8.2
1%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2026-60680
8.1
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60415
8.1
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60312
8.1
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60201
8.1
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2023-22101
8.1
1%
Oct 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2020-11620
8.1
6%
Apr 7
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
Page 3 of 8 · 359 total
1234…8