Oracle Data Integrator vulnerabilities

44 CVEs affecting Oracle Data Integrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60999, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2018-8013, published 2018-05-24. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of…
CVE-2020-36179, published 2021-01-07. High severity, CVSS 8.1. EPSS: 17.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-35728, published 2020-12-27. High severity, CVSS 8.1. EPSS: 12.5% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka…
CVE-2019-17195, published 2019-10-15. Critical severity, CVSS 9.8. EPSS: 11.1% chance of exploitation in the next 30 days. Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential…
CVE-2017-5611, published 2017-01-30. Critical severity, CVSS 9.8. EPSS: 10.2% chance of exploitation in the next 30 days. SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected…
CVE-2019-17359, published 2019-10-08. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
CVE-2020-13956, published 2020-12-02. Medium severity, CVSS 5.3. EPSS: 9% chance of exploitation in the next 30 days. Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host…
CVE-2020-36188, published 2021-01-06. High severity, CVSS 8.1. EPSS: 8.8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2018-7318, published 2018-02-22. Critical severity, CVSS 9.8. EPSS: 8.7% chance of exploitation in the next 30 days. SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.

Latest

CVE-2026-60999, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability…
CVE-2026-60723, published 2026-07-21. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2026-60625, published 2026-07-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2026-60320, published 2026-07-21. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60319, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60318, published 2026-07-21. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-47056, published 2026-07-21. Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2026-35262, published 2026-06-17. High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…