Known Vulnerabilities for Application Express by Oracle
Listed below are 10 of the newest known vulnerabilities associated with "Application Express" by "Oracle".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-119285 json | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wild... | Not Provided | 2026-10-29 | 2026-11-04 |
| CVE-2026-111771 json | The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol... | Not Provided | 2026-11-05 | 2026-11-10 |
| CVE-2026-111181 json | body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2... | Not Provided | 2026-10-22 | 2026-10-22 |
| CVE-2026-110816 json | ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when a... | Not Provided | 2026-10-14 | 2026-10-16 |
| CVE-2026-96897 json | The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that... | Not Provided | 2026-09-27 | 2026-09-28 |
| CVE-2026-92395 json | @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it bac... | Not Provided | 2026-09-16 | 2026-09-17 |
| CVE-2026-90711 json | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Expres... | Not Provided | 2026-09-15 | 2026-09-15 |
| CVE-2026-82417 json | ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-81907 json | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST... | Not Provided | 2026-09-11 | 2026-09-14 |
| CVE-2026-71886 json | In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust d... | Not Provided | 2026-10-03 | 2026-10-05 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Application Express | 5.1.4.00.08 | |||
| Application | Oracle | Application Express | 5.1.4 | |||
| Application | Oracle | Application Express | 5.1.3.00.05 | |||
| Application | Oracle | Application Express | 5.1.3 | |||
| Application | Oracle | Application Express | 5.1.2.00.09 | |||
| Application | Oracle | Application Express | 5.1.2 | |||
| Application | Oracle | Application Express | 5.1.1 | |||
| Application | Oracle | Application Express | 5.1.0 | |||
| Application | Oracle | Application Express | 5.0.4 | |||
| Application | Oracle | Application Express | 5.0 | |||
| Application | Oracle | Application Express | 4.2 | |||
| Application | Oracle | Application Express | 4.1 | |||
| Application | Oracle | Application Express | 4.0 | |||
| Application | Oracle | Application Express | 3.2 | |||
| Application | Oracle | Application Express | 3.1 | |||
| Application | Oracle | Application Express | 3.0 | |||
| Application | Oracle | Application Express | 20.2 | |||
| Application | Oracle | Application Express | 20.1 | |||
| Application | Oracle | Application Express | 19.2 | |||
| Application | Oracle | Application Express | 19.1 |