EUVD-2026-79597

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2026-83245

Oracle Commerce Guided Search / Experience Manager (component: Forge ) version 11.4.0 is affected by a network-based, unauthenticated vulnerability exploitable via HTTP . The attack complexity is rated high (difficult to exploit), but successful exploitation can result in full takeover of the pro...

CVE-2026-83244

Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge ), version 11.4.0 , is affected by a difficult-to-exploit vulnerability exploitable by an unauthenticated attacker with access to the physical communication segment attached to the hardware where the product exec...

EUVD-2026-79593

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

EUVD-2026-79590

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83240

CVE-2026-83240 affects the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager , version 11.4.0 . A low-privileged local attacker with infrastructure logon can exploit this vulnerability with low complexity and no user interaction , leading to high integrity impa...

CVE-2026-83237

Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge ), version 11.4.0 , is affected by a network-based vulnerability reachable via HTTP. A low-privileged attacker with low complexity and no user interaction can achieve unauthorized access to all accessible data (h...

EUVD-2026-79586

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-79400

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83072

CVE-2026-83072 is an easily exploitable vulnerability in the Search Bean [Incl. Advanced] component of Oracle Applications Framework within Oracle E-Business Suite , affecting supported versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can compromise the com...

CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference IDOR in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved sear...

CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference IDOR in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved sear...

EUVD-2026-79237

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference IDOR in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved sear...

CVE-2026-18423

Concrete CMS versions 9.0.0 through 9.5.2 contain an Insecure Direct Object Reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity can permanently delete (with no undo) or rename saved search pres...

CVE-2026-92180

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

CVE-2026-68529

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

EUVD-2026-79184

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

CVE-2026-68529

Concrete CMS 9.0.0 through 9.5.2 contained an authorization bypass in the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity from a user-supplied entity ID without invoking canViewExpressEntries(), ...

CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...