Login Request a demo
WS
App Server
WebLogic Server
by Oracle · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
359
CVEs
16
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities359In the news5Timeline
Severity mix
Critical 107High 112Medium 124Low 4
Severity
All severities359Critical107High112Medium124Low4
Exploitation
On CISA KEV16Exploited in the wild16
Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-24891
6.1
2%
Apr 27
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-29577
6.1
1%
Apr 21
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21453
6.1
1%
Apr 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21386
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21361
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21262
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21261
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21260
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21259
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2022-21258
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 14.1.1.0.0
CVE-2022-21257
6.1
1%
Jan 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-41184
6.1
41%
Oct 26
jQuery-UI is the official jQuery user interface library
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-41183
6.1
9%
Oct 26
jQuery-UI is the official jQuery user interface library
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-41182
6.1
39%
Oct 26
jQuery-UI is the official jQuery user interface library
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2142
6.1
1%
Apr 22
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0
CVE-2020-14640
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14638
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14637
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14636
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14572
6.1
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11022
6.1
99%
Apr 29
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0; 10.3.6.0.0; +4 more
CVE-2020-2811
6.1
1%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2889
6.1
1%
Oct 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps)
Affected: 12.2.1.3.0
CVE-2018-3250
6.1
2%
Oct 17
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0.0
CVE-2018-2987
6.1
1%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 12.1.3.0; 12.2.1.3
CVE-2017-10178
6.1
1%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2016-7103
6.1
29%
Mar 15
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2016-3416
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2016-0700
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0
CVE-2016-0675
6.1
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and…
Affected: 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0
CVE-2026-101515
5.9
0%
Oct 20
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2021-2211
5.9
2%
Apr 22
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 10.3.6.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2021-27568
5.9
3%
Feb 23
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2018-11039
5.9
3%
Jun 25
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2018-10237
5.9
5%
Apr 26
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this…
Affected: 12.2.1.3.0
CVE-2017-10148
5.8
3%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2022-21557
5.7
0%
Jul 19
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21960
5.6
0%
Apr 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-12400
5.5
1%
Aug 23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2019-2827
5.5
1%
Jul 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2824
5.5
1%
Jul 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2019-2618
5.5
33%
Apr 23
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2018-11771
5.5
5%
Aug 16
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after…
Affected: 14.1.1.0.0
CVE-2018-1324
5.5
4%
Mar 16
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes…
Affected: 14.1.1.0.0
CVE-2020-2966
5.4
1%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2395
5.4
1%
Jan 16
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Affected: 10.3.6.0
CVE-2018-2998
5.4
1%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: SAML)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2016-0696
5.4
2%
Apr 21
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors…
Affected: 10.3.6.0.0
CVE-2025-61764
5.3
0%
Oct 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0
Page 6 of 8 · 359 total
1…5678