oracle business process management suite

Name: oracle business process management suite
Brand: oracle

productUS

cpe:2.3:a:oracle:business_process_management_suite:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

10critical13high7medium0low

updated 2026-10-27

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-11358US	medium6.1	86.8% (100th)	Exploit	no fix	2019-04-20	2 versions
CVE-2021-4104US	high7.5	80.6% (100th)	Exploit	no fix	2021-12-14	2 versions
CVE-2022-23305US	critical9.8	66.5% (99th)	Exploit	no fix	2022-01-18	2 versions
CVE-2015-9251US	medium6.1	29.7% (98th)	Exploit	no fix	2018-01-18	3 versions
CVE-2018-11761US	high7.5	9.38% (95th)	Exploit	no fix	2018-09-19	2 versions
CVE-2019-10219US	medium6.1	2.16% (82nd)	Exploit	no fix	2019-11-08	2 versions
CVE-2022-23302US	high8.8	63.8% (99th)	—	no fix	2022-01-18	2 versions
CVE-2022-23307US	high8.8	54.4% (99th)	—	no fix	2022-01-18	2 versions
CVE-2019-2904US	critical9.8	14.3% (97th)	—	no fix	2019-10-16	2 versions
CVE-2021-36090US	high7.5	12.9% (96th)	—	no fix	2021-07-13	2 versions
CVE-2018-14718US	critical9.8	12.7% (96th)	—	no fix	2019-01-02	2 versions
CVE-2021-35516US	high7.5	12.4% (96th)	—	no fix	2021-07-13	2 versions
CVE-2021-35515US	high7.5	11.6% (96th)	—	no fix	2021-07-13	2 versions
CVE-2021-35517US	high7.5	10.6% (96th)	—	no fix	2021-07-13	2 versions
CVE-2018-19362US	critical9.8	10.6% (96th)	—	no fix	2019-01-02	2 versions
CVE-2018-19361US	critical9.8	10.6% (96th)	—	no fix	2019-01-02	2 versions
CVE-2018-19360US	critical9.8	10.6% (96th)	—	no fix	2019-01-02	2 versions
CVE-2018-14719US	critical9.8	9.68% (95th)	—	no fix	2019-01-02	2 versions
CVE-2019-17359US	high7.5	8.77% (95th)	—	no fix	2019-10-08	2 versions
CVE-2020-10683US	critical9.8	7.27% (94th)	—	no fix	2020-05-01	2 versions
CVE-2021-37714US	high7.5	6.69% (94th)	—	no fix	2021-08-18	2 versions
CVE-2018-1000613US	critical9.8	4.77% (92nd)	—	no fix	2018-07-09	3 versions
CVE-2018-1000180US	high7.5OT elevated	3.42% (89th)	—	no fix	2018-06-05	3 versions
CVE-2020-1950US	medium5.5	2.99% (87th)	—	no fix	2020-03-23	2 versions
CVE-2018-3246US	high7.5	2.95% (87th)	—	no fix	2018-10-17	3 versions
CVE-2020-1951US	medium5.5	2.89% (87th)	—	no fix	2020-03-23	2 versions
CVE-2018-3100US	critical9.1	2.66% (86th)	—	no fix	2018-07-18	5 versions
CVE-2019-2706US	high8.2	2.01% (81st)	—	no fix	2019-04-23	= 11.1.1.9.0
CVE-2020-1945US	medium6.3	1.77% (78th)	—	no fix	2020-05-14	2 versions
CVE-2020-17521US	medium5.5OT elevated	1.03% (63rd)	—	no fix	2020-12-07	2 versions
CVE-2026-60542US	—	0.43% (37th)	—	no fix	2026-07-21	2 versions
CVE-2026-34284US	—	0.18% (7th)	—	no fix	2026-04-21	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-502Deserialization of Untrusted Data9 CVEs
CWE-284Improper Access Control5 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-130Improper Handling of Length Parameter Inconsistency3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan