Oracle Communications Converged Application Server vulnerabilities

16 CVEs affecting Oracle Communications Converged Application Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61226, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2725: Oracle WebLogic Server, Injection, published 2019-04-26. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 100% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable…
CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1275, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 57.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1271, published 2018-04-06. Medium severity, CVSS 5.9. EPSS: 34.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS,…
CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2018-1000613, published 2018-07-09. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code…
CVE-2018-1000180, published 2018-06-05. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added…
CVE-2018-1272, published 2018-04-06. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux…
CVE-2018-1257, published 2018-05-11. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-3246, published 2018-10-17. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily…

Latest

CVE-2026-61226, published 2026-07-21. High severity, CVSS 7.5. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy). The supported version that is affected is 8.3. Difficult to exploit…
CVE-2026-61225, published 2026-07-21. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 8.2 and 8.3. Difficult to…
CVE-2026-61224, published 2026-07-21. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). The supported version that is affected is 8.3. Difficult to exploit…
CVE-2026-61223, published 2026-07-21. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). Supported versions that are affected are 8.2 and 8.3. Difficult to…
CVE-2023-21890, published 2023-01-18. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 7.1.0 and 8.0.0. Easily…
CVE-2018-1258, published 2018-05-11. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain…