Oracle Agile Engineering Data Management vulnerabilities

45 CVEs affecting Oracle Agile Engineering Data Management, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71053, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2020-13935, published 2020-07-14. High severity, CVSS 7.5. EPSS: 86.6% chance of exploitation in the next 30 days. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could…
CVE-2020-13934, published 2020-07-14. High severity, CVSS 7.5. EPSS: 64.1% chance of exploitation in the next 30 days. An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of…
CVE-2020-9484, published 2020-05-20. High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
CVE-2017-3730, published 2017-05-04. High severity, CVSS 7.5. EPSS: 55.3% chance of exploitation in the next 30 days. In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a…
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…

Latest

CVE-2026-71053, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Web Services Security). The supported version that is affected is 6.2.1. Difficult to…
CVE-2026-71052, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Web Services Security). The supported version that is affected is 6.2.1. Easily exploitable…
CVE-2026-70712, published 2026-08-18. Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Difficult to exploit…
CVE-2026-70698, published 2026-08-18. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability…
CVE-2026-70697, published 2026-08-18. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1.…
CVE-2026-70693, published 2026-08-18. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1.…
CVE-2026-70691, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1.…
CVE-2026-61195, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability…
CVE-2026-61194, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability…
CVE-2026-61192, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Difficult to exploit…