Oracle Application Testing Suite vulnerabilities

82 CVEs affecting Oracle Application Testing Suite, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70868, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
CVE-2016-0492, published 2016-01-21. Medium severity, CVSS 6.4. EPSS: 92.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and…
CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2016-0491, published 2016-01-21. Medium severity, CVSS 6.4. EPSS: 79.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and…
CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2019-17571, published 2019-12-20. Critical severity, CVSS 9.8. EPSS: 70% chance of exploitation in the next 30 days. Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization…

Latest

CVE-2026-70868, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via…
CVE-2026-70867, published 2026-08-18. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical…
CVE-2026-70866, published 2026-08-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web…
CVE-2026-70865, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker having Load Testing for Web…
CVE-2026-70864, published 2026-08-18. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web…
CVE-2026-70863, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web…
CVE-2026-70862, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP…
CVE-2026-46924, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP…
CVE-2026-46876, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via…
CVE-2026-35290, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP…