What is the oracle CNA?

oracle is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 8,309 CVE records since 2008.

How many CVEs has oracle published?

oracle has published 8,309 CVE records, including 707 in the last two years.

What is oracle's CVE data quality grade?

RadicalNotion.AI grades oracle's CVE data quality as F, with an overall completeness score of 40.7%. This reflects how consistently its CVE records include vendor (60.3%), product (60.4%), CVSS (34.5%), and CWE (7.7%) information.

What products does oracle publish CVEs for?

oracle most frequently publishes CVEs for mysql, mysql-server, MySQL Server, jre, jdk.

Which vendors does oracle cover?

oracle publishes CVEs across 7 distinct vendors, most often Oracle Corporation, mysql, netapp, sun, canonical.

Is oracle actively publishing CVEs?

oracle is currently active, based on 707 CVEs in the last two years.

What is the average severity of oracle's CVEs?

The average CVSS base score across oracle's scored CVEs is 6.0.

How many critical CVEs has oracle published?

oracle has published 683 critical-severity CVEs and 2,022 high-severity CVEs.

Are any of oracle's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 43 of oracle's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in oracle's CVEs?

oracle's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-400 (Uncontrolled Resource Consumption), CWE-306 (Missing Authentication for Critical Function), CWE-863 (Incorrect Authorization).

How does oracle rank among CNAs?

By total CVE volume, oracle ranks #9 of 370 CNAs, and it reports more complete CVE records than 4% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade F

Active

oracle

Name: oracle CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published January 20, 2026

8,309

CVEs published

Total assigned

17.3

Years active

2008–2026

6.0

Avg CVSS

Across scored CVEs

707

Recent CVEs

Last 2 years

Overview

oracle is a CVE Numbering Authority that has published 8,309 CVE records since 2008. It is currently classified as active, with 707 CVEs published in the last two years. Its CVE data quality is graded F (40.7% overall completeness).

Among the 370 CNAs tracked here, oracle ranks #9 by CVE volume and reports more complete records than 4% of all CNAs.

Data quality report card

How complete and consistent oracle's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often oracle also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

F

40.7%

Overall score

Overall completeness40.7%

Vendor completeness60.3%

Product completeness60.4%

CVSS completeness34.5%

CWE completeness7.7%

99.3%

Update rate

Records revised after publishing

7

Vendor diversity

Distinct vendors covered

554 chars

Avg description length

Per CVE record

2008-10-14

First CVE date

Earliest assignment

2026-01-20

Latest CVE date

Most recent assignment

6.0

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of oracle's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical683

High2,022

Medium5,035

Low945

2 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

43

43 of oracle's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories oracle most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs oracle has published each year.

2019

613

2020

811

2021

586

2022

416

2023

295

2024

370

2025

314

2026

444

12-month change

How oracle's CVE data quality has shifted over the trailing year.

Previous grade

F

Current grade

C

Score change

36.6% → 74.9% (+38.3%)

Improved most in CVSS Completeness (+69.1 pts)

Top vendors

The vendors oracle publishes the most CVEs for.

Oracle Corporation8,417 CVEs
mysql1,161 CVEs
netapp858 CVEs
sun453 CVEs
canonical453 CVEs
debian417 CVEs
Red Hat411 CVEs
mariadb305 CVEs

Top products

The products oracle publishes the most CVEs for.

mysql1,194 CVEs
mysql-server1,133 CVEs
MySQL Server1,018 CVEs
jre884 CVEs
jdk871 CVEs
oncommand_insight807 CVEs
oncommand workflow automation638 CVEs
active iq unified manager499 CVEs

Latest CVEs

The most recent CVEs assigned by oracle.

CVE-2026-46979CWE-284
Medium · CVSS 6.5
EPSS 0.3%2026-06-16
CVE-2026-46978CWE-284
Critical · CVSS 10.0
EPSS 0.3%2026-06-16
CVE-2026-46977CWE-200
Low · CVSS 3.2
EPSS 0.2%2026-06-16
CVE-2026-46976CWE-284
High · CVSS 7.2
EPSS 0.3%2026-06-16
CVE-2026-46974CWE-284
High · CVSS 7.5
EPSS 0.1%2026-06-16
CVE-2026-46973CWE-287
High · CVSS 8.8
EPSS 0.4%2026-06-16
CVE-2026-46972CWE-269
High · CVSS 8.8
EPSS 0.3%2026-06-16
CVE-2026-46971CWE-284
High · CVSS 7.5
EPSS 0.2%2026-06-16
CVE-2026-46970CWE-269
High · CVSS 7.2
EPSS 0.5%2026-06-16
CVE-2026-46969CWE-284
High · CVSS 7.2
EPSS 0.5%2026-06-16
CVE-2026-46967CWE-284
High · CVSS 8.8
EPSS 0.4%2026-06-16
CVE-2026-46966CWE-284
High · CVSS 7.5
EPSS 0.3%2026-06-16

Track new oracle CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor oracle CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the oracle CNA.

What is the oracle CNA?: oracle is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 8,309 CVE records since 2008.
How many CVEs has oracle published?: oracle has published 8,309 CVE records, including 707 in the last two years.
What is oracle's CVE data quality grade?: RadicalNotion.AI grades oracle's CVE data quality as F, with an overall completeness score of 40.7%. This reflects how consistently its CVE records include vendor (60.3%), product (60.4%), CVSS (34.5%), and CWE (7.7%) information.
What products does oracle publish CVEs for?: oracle most frequently publishes CVEs for mysql, mysql-server, MySQL Server, jre, jdk.
Which vendors does oracle cover?: oracle publishes CVEs across 7 distinct vendors, most often Oracle Corporation, mysql, netapp, sun, canonical.
Is oracle actively publishing CVEs?: oracle is currently active, based on 707 CVEs in the last two years.
What is the average severity of oracle's CVEs?: The average CVSS base score across oracle's scored CVEs is 6.0.
How many critical CVEs has oracle published?: oracle has published 683 critical-severity CVEs and 2,022 high-severity CVEs.
Are any of oracle's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 43 of oracle's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in oracle's CVEs?: oracle's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-400 (Uncontrolled Resource Consumption), CWE-306 (Missing Authentication for Critical Function), CWE-863 (Incorrect Authorization).
How does oracle rank among CNAs?: By total CVE volume, oracle ranks #9 of 370 CNAs, and it reports more complete CVE records than 4% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track oracle CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing