Oracle Communications Pricing Design Center vulnerabilities

42 CVEs affecting Oracle Communications Pricing Design Center, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47007, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability, published 2020-12-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.9% chance of exploitation in the next 30 days. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2021-33037, published 2021-07-12. Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request…
CVE-2021-23336, published 2021-02-15. Medium severity, CVSS 5.9. EPSS: 40.7% chance of exploitation in the next 30 days. The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2021-3177, published 2021-01-19. Critical severity, CVSS 9.8. EPSS: 24.2% chance of exploitation in the next 30 days. Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as…
CVE-2020-25649, published 2020-12-03. High severity, CVSS 7.5. EPSS: 17.7% chance of exploitation in the next 30 days. A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from…
CVE-2020-36179, published 2021-01-07. High severity, CVSS 8.1. EPSS: 17.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-10543, published 2020-06-05. High severity, CVSS 8.2. EPSS: 11.3% chance of exploitation in the next 30 days. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

Latest

CVE-2026-47007, published 2026-07-21. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications (component: On-premise Deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0,…
CVE-2022-24329, published 2022-02-25. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
CVE-2022-21388, published 2022-01-19. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications Applications (component: On Premise Install). Supported versions that are affected are 12.0.0.3.0 and…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-30640, published 2021-07-12. Medium severity, CVSS 6.5. EPSS: 9.9% chance of exploitation in the next 30 days. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This…
CVE-2020-6950, published 2021-06-02. Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days. Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…