# Oracle Enterprise Manager Base Platform


- [CVE-2018-11776](https://insights.sbomify.com/CVE-2018-11776/): Apache Struts Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2026-46832](https://insights.sbomify.com/CVE-2026-46832/): Auth bypass in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46852](https://insights.sbomify.com/CVE-2026-46852/): Privilege escalation in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46854](https://insights.sbomify.com/CVE-2026-46854/): Auth bypass in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46855](https://insights.sbomify.com/CVE-2026-46855/): Auth bypass in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46994](https://insights.sbomify.com/CVE-2026-46994/): Auth bypass in Oracle Enterprise Manager Base Platform (critical 9.8)
- [CVE-2026-46857](https://insights.sbomify.com/CVE-2026-46857/): Auth bypass in Oracle Enterprise Manager Base Platform (critical 9.8)
- [CVE-2022-23305](https://insights.sbomify.com/CVE-2022-23305/): SQL injection in JDBC Appender in Apache Log4j V1 (critical 9.8)
- [CVE-2020-11972](https://insights.sbomify.com/CVE-2020-11972/): Deserialization of Untrusted Data in Apache Camel RabbitMQ (critical 9.8)
- [CVE-2020-11973](https://insights.sbomify.com/CVE-2020-11973/): Apache Camel Netty enables Java deserialization by default (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2020-2961](https://insights.sbomify.com/CVE-2020-2961/): Auth bypass in Enterprise Manager Base Platform (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/enterprise-manager-base-platform/