CVE-2026-71031

Oracle Commerce 11.4.0's Endeca Application Controller component is vulnerable via HTTP to an unauthenticated, easily exploitable attack requiring user interaction (CVSS 6.1). Successful attacks enable unauthorized read, update, insert, and delete access to affected data with scope change to addi...