AP
Product
Agile Product Lifecycle Management
On CISA KEVExploited in the wildRansomware-linked
151
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 74Medium 61Low 4
Watch
Add Agile Product Lifecycle Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-87258 | 7.6 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2026-87254 | 7.5 | Sep 15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments) Affected: 9.3.6 |
| CVE-2026-71043 | 7.5 | Aug 18 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2026-61172 | 7.5 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2025-21565 | 7.5 | Jan 21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install) Affected: 9.3.6 |
| CVE-2021-40690 | 7.5 | Sep 19 | Bypass of the secureValidation property Affected: 9.3.6 |
| CVE-2021-25122 | 7.5 | Mar 1 | Apache Tomcat h2c request mix-up Affected: 9.3.3; 9.3.6 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 9.3.6 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2020-13934 | 7.5 | Jul 14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2 Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 9.3.3 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 9.3.3; 9.3.4; 9.3.5; 9.3.6 |
| CVE-2018-11040 | 7.5 | Jun 25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON… Affected: 9.3.3; 9.3.4; 9.3.5 |
| CVE-2016-3526 | 7.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via vectors… Affected: 9.3.4; 9.3.5 |
| CVE-2026-61173 | 7.4 | Jul 21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security) Affected: 9.3.6 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 9.3.3; 9.3.5; 9.3.6 |
| CVE-2016-5526 | 7.3 | Oct 25 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3561 | 7.3 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3530 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3539 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2016-3538 | 7.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and… Affected: 9.3.4; 9.3.5 |
| CVE-2026-71041 | 7.0 | Aug 18 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart) Affected: 9.3.6 |
| CVE-2021-25329 | 7.0 | Mar 1 | Incomplete fix for CVE-2020-9484 Affected: 9.3.3; 9.3.6 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 9.3.3; 9.3.5; 9.3.6 |