CVE-2026-61152

The CVE-2026-61152 entry applies to Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) for version 11.4.0. The vulnerability is exploitable by a low-privileged attacker with network access over HTTP, potentially allowing unauthorized update/insert/d...

CVE-2025-61152

python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can craft a forged token with arbitrary claims e.g., isadmin=true and bypass authentication checks, leading to privilege escalation or unauthoriz...