Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2024-21182 — Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
|
Oracle | WebLogic Server | Jun 1, 2026 | Jun 4, 2026 | |
|
CVE-2020-2883 — Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
|
Oracle | WebLogic Server | Jan 7, 2025 | Jan 28, 2025 | |
|
CVE-2020-14644 — Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
|
Oracle | WebLogic Server | Sep 18, 2024 | Oct 9, 2024 | |
|
CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
|
Oracle | WebLogic Server | Jun 3, 2024 | Jun 24, 2024 | |
|
CVE-2023-21839 — Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
|
Oracle | WebLogic Server | May 1, 2023 | May 22, 2023 | |
|
CVE-2018-2628 — Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
|
Oracle | WebLogic Server | Sep 8, 2022 | Sep 29, 2022 | |
|
CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
|
Oracle | WebLogic Server | Feb 10, 2022 | Aug 10, 2022 | Ransomware |
|
CVE-2019-2725 — Oracle WebLogic Server, Injection
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
|
Oracle | WebLogic Server | Jan 10, 2022 | Jul 10, 2022 | Ransomware |
|
CVE-2015-4852 — Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
|
Oracle | WebLogic Server | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-14750 — Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
|
Oracle | WebLogic Server | Nov 3, 2021 | May 3, 2022 |
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
WebLogic Server · Jun 1, 2026
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
WebLogic Server · Jan 7, 2025
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
WebLogic Server · Sep 18, 2024
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
WebLogic Server · Jun 3, 2024
Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
WebLogic Server · May 1, 2023
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
WebLogic Server · Sep 8, 2022
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
WebLogic Server · Feb 10, 2022
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
WebLogic Server · Jan 10, 2022
Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
WebLogic Server · Nov 3, 2021
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
WebLogic Server · Nov 3, 2021