CVE Tools
Track your stack

Primavera Unifier

111 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Primavera Unifier, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Primavera Unifier CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Primavera Unifier CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-103
2026-110

Severity

How the 111 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2220%
  • High4742%
  • Medium4036%
  • Low22%

Latest CVEs

The 15 most recently published vulnerabilities affecting Primavera Unifier.

  1. CVE-2026-101736Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerabili...7.4
  2. CVE-2026-101735Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vu...7.1
  3. CVE-2026-101475Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23....6.5
  4. CVE-2023-52428In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (...7.5
  5. CVE-2020-10650A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.j...8.1
  6. CVE-2022-30126Apache Tika Regular Expression Denial of Service in Standards Extractor5.5
  7. CVE-2022-25169Apache Tika BPGParser Memory Usage DoS5.5
  8. CVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.7.5
  9. CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration6.6
  10. CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation5.9
  11. CVE-2021-23450Prototype Pollution7.5
  12. CVE-2021-41184XSS in the `of` option of the `.position()` util6.5
  13. CVE-2021-41182XSS in the `altField` option of the Datepicker widget6.5
  14. CVE-2021-42575The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.9.8
  15. CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and Clients5.9

Product grouping is registry-driven, with AI assist and human review. How it works