Class familyOracle · WebLogic Server
Oracle WebLogic Server deserialization flaws, 2015–2026
4 WebLogic Server CVEs with CWE-502 weaknesses, 18 Nov 2015 to 16 Jun 2026. 3 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2015’15
2016’16
2017’17
1 2018’18
2019’19
2020’20
2021’21
2022’22
1 2023’23
2024’24
2025’25
1 2026’26
In CISA KEVNot in KEV
20151 CVE, 1 in KEV
20181 CVE, 1 in KEV
20231 CVE, 1 in KEV
20261 CVE
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2015-4852KEV | 18 Nov 2015 | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | Grouped by weakness | 69.8 |
| CVE-2018-2628KEV | 19 Apr 2018 | Oracle WebLogic Server Unspecified Vulnerability | Grouped by weakness | 69.9 |
| CVE-2023-21839KEV | 18 Jan 2023 | Oracle WebLogic Server Unspecified Vulnerability | Grouped by weakness | 72.1 |
| CVE-2026-35300 | 16 Jun 2026 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core) | Grouped by weakness | 16.2 |