Oracle Essbase vulnerabilities

25 CVEs affecting Oracle Essbase, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70689, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2021-22901, published 2021-06-11. High severity, CVSS 8.1. EPSS: 63.5% chance of exploitation in the next 30 days. curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2019-12402, published 2019-08-30. High severity, CVSS 7.5. EPSS: 16.2% chance of exploitation in the next 30 days. The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service…
CVE-2020-8285, published 2020-12-14. High severity, CVSS 7.5. EPSS: 9.8% chance of exploitation in the next 30 days. curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2021-23841, published 2021-02-16. Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-7760, published 2020-10-30. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in…
CVE-2021-22876, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 5.3% chance of exploitation in the next 30 days. curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip…

Latest

CVE-2026-70689, published 2026-08-18. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Infrastructure). The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
CVE-2026-70688, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Calculator). The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access…
CVE-2025-61763, published 2025-10-21. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network…
CVE-2023-22010, published 2023-07-18. Low severity, CVSS 2.2. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerability allows high privileged attacker with…
CVE-2023-21944, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with…
CVE-2023-21943, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with…
CVE-2023-21942, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with…
CVE-2022-21508, published 2022-07-19. Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.3. Easily exploitable vulnerability allows high privileged attacker with logon to…