Login Request a demo
WS
App Server
WebLogic Server
by Oracle · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
359
CVEs
16
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities359In the news5Timeline
Severity mix
Critical 107High 112Medium 124Low 4
Severity
All severities359Critical107High112Medium124Low4
Exploitation
On CISA KEV16Exploited in the wild16
Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-21182
In wildKEV
7.5
74%
Jul 16
Oracle WebLogic Server Unspecified Vulnerability
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2023-21839
In wildKEV
7.5
100%
Jan 17
Oracle WebLogic Server Unspecified Vulnerability
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2017-10271
RansomwareIn wildKEV
7.5
100%
Oct 19
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2017-3506
In wildKEV
7.4
96%
Apr 24
Oracle WebLogic Server OS Command Injection Vulnerability
Affected: 10.3.6.0; 12.1.3.0; 12.2.1.0; 12.2.1.1; 12.2.1.2
CVE-2020-14883
In wildKEV
7.2
98%
Oct 21
Oracle WebLogic Server Unspecified Vulnerability
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2026-60343
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-60313
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60207
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-60203
8.8
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-35311
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-35303
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-35299
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-35259
8.8
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2022-23307
8.8
54%
Jan 18
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2022-23302
8.8
64%
Jan 18
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-11113
8.8
6%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11112
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11111
8.8
4%
Mar 31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10969
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10968
8.8
4%
Mar 26
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10673
8.8
8%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-10672
8.8
3%
Mar 18
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2018-1258
8.8
2%
May 11
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security
Affected: 10.3.6.0; 12.1.3.0; 12.2.1.2; 12.2.1.3
CVE-2016-3505
8.8
6%
Oct 25
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect…
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0
CVE-2026-35258
8.7
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60699
8.6
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60293
8.6
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2024-20927
8.6
1%
Feb 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2017-10147
8.6
4%
Aug 8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2026-60196
8.4
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.2.0.0
CVE-2026-35302
8.3
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2018
8.3
1%
Jan 20
Vulnerability in the Advanced Networking Option component of Oracle Database Server
Affected: 12.2.1.3.0
CVE-2018-2935
8.3
2%
Jul 18
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JSF)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3
CVE-2020-11987
8.2
13%
Feb 24
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
Affected: 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-14588
8.2
2%
Jul 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2867
8.2
1%
Apr 15
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container)
Affected: 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2026-60680
8.1
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60415
8.1
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60312
8.1
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60201
8.1
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2023-22101
8.1
1%
Oct 17
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2020-11620
8.1
6%
Apr 7
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2020-11619
8.1
4%
Apr 7
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: 12.2.1.3.0; 12.2.1.4.0
CVE-2019-2891
8.1
2%
Oct 16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2026-46848
7.9
0%
Jun 16
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2020-5258
7.7
4%
Mar 10
Prototype pollution in dojo
Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2026-60528
7.6
0%
Jul 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60679
7.5
0%
Aug 18
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-34305
7.5
0%
Apr 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2025-61752
7.5
0%
Oct 21
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Affected: 14.1.1.0.0; 14.1.2.0.0
Page 1 of 3 · 112 total
123