Oracle Rest Data Services vulnerabilities

34 CVEs affecting Oracle Rest Data Services, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46843, published 2026-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2021-28169, published 2021-06-09. Medium severity, CVSS 5.3. EPSS: 78.5% chance of exploitation in the next 30 days. For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2021-41184, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 40.8% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code.…
CVE-2021-41182, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 39.4% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted…
CVE-2017-7658, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the…
CVE-2017-7657, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 14.9% chance of exploitation in the next 30 days. In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk…

Latest

CVE-2026-46843, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
CVE-2026-46842, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
CVE-2026-46841, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
CVE-2026-46840, published 2026-05-28. Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker…
CVE-2026-46839, published 2026-05-28. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network…
CVE-2026-46830, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with…
CVE-2026-46829, published 2026-05-28. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with…
CVE-2026-46775, published 2026-05-28. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network…
CVE-2026-35277, published 2026-05-28. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network…
CVE-2026-35266, published 2026-05-28. High severity, CVSS 7.9. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network…