Oracle Corporation Oracle VM VirtualBox

Name: Oracle Corporation Oracle VM VirtualBox
Brand: Oracle Corporation

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical19high4medium1low

updated 2026-10-28

vulnerabilities (98)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-3558US	high8.5	2.91% (87th)	Exploit	5.1.20	2017-04-24	2 versions
CVE-2017-10129US	high8.8	1.64% (76th)	Exploit	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10204US	high8.8	1.62% (76th)	Exploit	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-3576US	high8.8	1.54% (75th)	Exploit	5.1.20	2017-04-24	2 versions
CVE-2017-3561US	high8.8	1.54% (75th)	Exploit	5.0.38	2017-04-24	2 versions
CVE-2017-3587US	high8.4	1.46% (73rd)	Exploit	5.1.20	2017-04-24	2 versions
CVE-2017-3575US	high7.9	1.44% (73rd)	Exploit	5.1.20	2017-04-24	2 versions
CVE-2017-3563US	high8.8	1.36% (72nd)	Exploit	5.1.20	2017-04-24	2 versions
CVE-2017-10235US	medium6.7	0.83% (58th)	Exploit	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2025-30712US	—	0.61% (49th)	Exploit	no fix	2025-04-15	≤ 7.1.6
CVE-2026-21955US	—	0.31% (23rd)	Exploit	no fix	2026-01-20	2 versions
CVE-2025-53024US	—	0.29% (21st)	Exploit	no fix	2025-07-15	≤ 7.1.10
CVE-2025-62641US	—	0.21% (11th)	Exploit	no fix	2025-10-21	2 versions
CVE-2026-21986US	—	0.20% (10th)	Exploit	no fix	2026-01-20	2 versions
CVE-2017-10233US	high7.3	0.42% (36th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10240US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10236US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10210US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10209US	medium5.2	0.41% (36th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10242US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10241US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10239US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10238US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10237US	high7.3	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-10187US	medium4.6	0.41% (35th)	—	5.1.24	2017-08-08	unspecified → 5.1.24
CVE-2017-3559US	high7.9	0.39% (32nd)	—	5.0.38	2017-04-24	2 versions
CVE-2024-21273US	—	0.36% (30th)	—	7.1.2	2024-10-15	2 versions
CVE-2017-3513US	low2.5	0.36% (30th)	—	5.1.20	2017-04-24	2 versions
CVE-2025-53026US	—	0.35% (29th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2017-3538US	high7.5	0.35% (29th)	—	5.1.16	2017-04-24	2 versions
CVE-2025-53025US	—	0.35% (29th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2026-21956US	—	0.31% (23rd)	—	no fix	2026-01-20	2 versions
CVE-2025-21533US	—OT elevated	0.30% (22nd)	—	7.0.24	2025-01-21	2 versions
CVE-2025-21571US	—	0.29% (22nd)	—	7.1.6	2025-01-21	2 versions
CVE-2024-21263US	—	0.29% (21st)	—	7.1.2	2024-10-15	2 versions
CVE-2025-30719US	—	0.29% (21st)	—	no fix	2025-04-15	≤ 7.1.6
CVE-2025-53028US	—	0.28% (20th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2025-53027US	—	0.28% (20th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2026-21963US	—	0.28% (20th)	—	no fix	2026-01-20	2 versions
CVE-2026-21985US	—	0.27% (20th)	—	no fix	2026-01-20	2 versions
CVE-2024-21253US	—	0.27% (20th)	—	7.0.22	2024-10-15	* → 7.0.22
CVE-2025-53030US	—	0.27% (19th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2024-21259US	—OT elevated	0.27% (19th)	—	7.0.22	2024-10-15	2 versions
CVE-2026-21982US	medium6.4	0.26% (17th)	—	no fix	2026-01-20	2 versions
CVE-2026-35245US	—	0.25% (17th)	—	no fix	2026-04-21	≤ 7.2.6
CVE-2025-53029US	—	0.25% (16th)	—	no fix	2025-07-15	≤ 7.1.10
CVE-2026-21957US	—	0.25% (16th)	—	no fix	2026-01-20	2 versions
CVE-2025-30725US	—	0.24% (14th)	—	no fix	2025-04-15	≤ 7.1.6
CVE-2026-21984US	—	0.23% (14th)	—	no fix	2026-01-20	2 versions
CVE-2026-21983US	—	0.23% (14th)	—	no fix	2026-01-20	2 versions

showing 50 of 98

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation27 CVEs
CWE-284Improper Access Control27 CVEs
CWE-269Improper Privilege Management23 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor10 CVEs
CWE-400Uncontrolled Resource Consumption10 CVEs
CWE-266Incorrect Privilege Assignment8 CVEs
CWE-267Privilege Defined With Unsafe Actions6 CVEs
CWE-190Integer Overflow or Wraparound4 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)98 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan