Oracle Flexcube Universal Banking vulnerabilities

95 CVEs affecting Oracle Flexcube Universal Banking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21978, published 2026-01-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2022-23437, published 2022-01-24. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop,…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…
CVE-2021-35517, published 2021-07-13. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-37714, published 2021-08-18. High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days. jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input,…
CVE-2021-41973, published 2021-11-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer…
CVE-2019-12399, published 2020-01-14. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to…

Latest

CVE-2026-21978, published 2026-01-20. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing). Supported versions that are affected are…
CVE-2023-22119, published 2023-10-17. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3…
CVE-2023-22118, published 2023-10-17. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3…
CVE-2023-22117, published 2023-10-17. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3…
CVE-2022-21579, published 2022-07-19. Medium severity, CVSS 6.4. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and…
CVE-2022-21578, published 2022-07-19. Medium severity, CVSS 6.7. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and…
CVE-2022-21577, published 2022-07-19. Medium severity, CVSS 6.4. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and…
CVE-2022-21576, published 2022-07-19. Medium severity, CVSS 6.4. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3…
CVE-2022-21544, published 2022-07-19. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and…
CVE-2022-21428, published 2022-07-19. Medium severity, CVSS 6.7. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and…