Oracle Hyperion Financial Reporting vulnerabilities

42 CVEs affecting Oracle Hyperion Financial Reporting, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70794, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-0228, published 2019-04-17. Critical severity, CVSS 9.8. EPSS: 9.5% chance of exploitation in the next 30 days. Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVE-2016-3493, published 2016-07-21. Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Hyperion Financial Reporting component in Oracle Hyperion 11.1.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related…
CVE-2021-27906, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3.3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2017-10310, published 2017-10-19. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected is 11.1.2. Easily exploitable…
CVE-2021-27807, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2018-2907, published 2018-07-18. High severity, CVSS 8.6. EPSS: 2.7% chance of exploitation in the next 30 days. Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected is 11.1.2. Easily exploitable vulnerability…
CVE-2017-10358, published 2017-10-19. Medium severity, CVSS 6.4. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Workspace). The supported version that is affected is 11.1.2. Easily exploitable vulnerability…
CVE-2019-2959, published 2019-10-16. Medium severity, CVSS 4.2. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Security Models). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability…

Latest

CVE-2026-70794, published 2026-08-18. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70793, published 2026-08-18. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70789, published 2026-08-18. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70788, published 2026-08-18. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability…
CVE-2026-70787, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability…
CVE-2026-70785, published 2026-08-18. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70784, published 2026-08-18. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70780, published 2026-08-18. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70776, published 2026-08-18. Low severity, CVSS 2.6. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…
CVE-2026-70769, published 2026-08-18. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability…