Oracle Product Lifecycle Analytics vulnerabilities

14 CVEs affecting Oracle Product Lifecycle Analytics, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71051, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2021-44832, published 2021-12-28. Medium severity, CVSS 6.6. EPSS: 97.9% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender…
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2022-23437, published 2022-01-24. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop,…
CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2026-61175, published 2026-07-21. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…
CVE-2026-61176, published 2026-07-21. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…
CVE-2026-71050, published 2026-08-18. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…

Latest

CVE-2026-71051, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…
CVE-2026-71049, published 2026-08-18. High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…
CVE-2026-71048, published 2026-08-18. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…
CVE-2026-61174, published 2026-07-21. Critical severity, CVSS 9.0. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable…