Application Performance Management
Vendor:
First CVE: Sep 18, 2019 · Active for 6 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Application Performance Management over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 18, 2019
6 years ago
Most Recent CVE
Jun 16, 2026
39 days ago
CVE Severity & Scoring
Application Performance Management8 CVEs
75%
13%
13%
All CVEs352,427 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (75.0%)
High2 (25.0%)
Unknown0 (0.0%)
User Interaction
None3 (37.5%)
Unknown0 (0.0%)
Required5 (62.5%)
Privileges Required
Low0 (0.0%)
High1 (12.5%)
None7 (87.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-46858CRITICAL Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13. | Jun 16, 2026 | 9.1 | 31 | NO | NO |
CVE-2021-2351HIGH Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulne | Jul 21, 2021 | 8.3 | 28 | NO | NO |
CVE-2021-29425MEDIUM In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, | Apr 13, 2021 | 4.8 | 24 | NO | NO |
CVE-2019-3740MEDIUM RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attack | Sep 18, 2019 | 6.5 | 24 | NO | NO |
CVE-2019-10219MEDIUM A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments an | Nov 8, 2019 | 6.1 | 23 | NO | NO |
CVE-2019-3739MEDIUM RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacke | Sep 18, 2019 | 6.5 | 22 | NO | NO |
CVE-2019-3738MEDIUM RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnera | Sep 18, 2019 | 6.5 | 22 | NO | NO |
CVE-2020-2946MEDIUM Vulnerability in the Application Performance Management product of Oracle Enterprise Manager (component: EM Request Monitoring). Supported versions that are affected are 12.1.0.5, | Apr 15, 2020 | 6.0 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Application Performance Management
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 24.1 | 1 | 9.1 | 0.4% | 0 | 0 |
| 13.5.1.0 | 3 | 6.4 | 5.0% | 0 | 0 |
| 13.5 | 1 | 9.1 | 0.4% | 0 | 0 |
| 13.4.1.0 | 3 | 6.4 | 5.0% | 0 | 0 |
| 13.4.0.0 | 3 | 6.5 | 2.7% | 0 | 0 |
| 13.3.0.0 | 4 | 6.4 | 2.3% | 0 | 0 |
| 13.2.0.0 | 1 | 6.0 | 1.3% | 0 | 0 |
| 12.1.0.5 | 1 | 6.0 | 1.3% | 0 | 0 |