Oracle Banking Trade Finance Process Management vulnerabilities

15 CVEs affecting Oracle Banking Trade Finance Process Management, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61097, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2021-29505, published 2021-05-28. High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2019-0228, published 2019-04-17. Critical severity, CVSS 9.8. EPSS: 9.5% chance of exploitation in the next 30 days. Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-8203, published 2020-07-15. High severity, CVSS 7.4. EPSS: 5.2% chance of exploitation in the next 30 days. Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2021-21409, published 2021-03-30. Medium severity, CVSS 5.9. EPSS: 4.9% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty…
CVE-2021-41973, published 2021-11-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer…
CVE-2019-12399, published 2020-01-14. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to…

Latest

CVE-2026-61097, published 2026-07-21. Critical severity, CVSS 9.6. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). Supported versions that are affected are 14.6.0-14.8.0.…
CVE-2022-21474, published 2022-04-19. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit…
CVE-2021-27906, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3.3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2021-27807, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.