33299 matches found
CVE-2026-71012
A low-privilege network attacker can exploit insufficient access control in Oracle Commerce Experience Manager 11.4.0 to read critical data and cause partial DoS (CVSS 7.1). Oracle released patches in its August 2026 Critical Patch Update; no in-the-wild exploitation is reported. Apply the update...
CVE-2026-71008
Oracle Commerce Experience Manager component in version 11.4.0 is affected by a network-reachable vulnerability exploitable by a high-privileged HTTP attacker, enabling unauthorized access to critical or all accessible data (CVSS 6.8, confidentiality impact). Exploitation details are not provided...
CVE-2026-71010
...
CVE-2026-71007
...
CVE-2026-71002
...
CVE-2026-71003
...
CVE-2026-71002
Oracle Commerce 11.4.0's Experience Manager component is vulnerable via HTTP; a low-privileged network attacker can modify or delete critical data with scope change (CVSS 8.5). No exploit code is provided. Apply Oracle's August 2026 CPU patches.
CVE-2026-70999
...
CVE-2026-70995
The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...
CVE-2026-70990
...
CVE-2026-70989
...
CVE-2026-70987
Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...
CVE-2026-70985
Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated, network-based HTTP attacks causing high confidentiality impact (CVSS 7.5). Oracle's August 2026 CPU advisory addresses it; no exploit or root-cause details are provided in the documents.
CVE-2026-70981
Oracle Commerce 11.4.0 Content Acquisition System is affected by a critical (CVSS 9.1) unauthenticated network-based vulnerability enabling unauthorized data modification and denial of service. No exploitation details are provided; refer to Oracle's August 2026 security alert for patch information.
CVE-2026-70972
...
CVE-2026-70973
...
CVE-2026-70970
...
CVE-2026-70971
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) has a network-reachable vulnerability allowing a low-privileged attacker to gain unauthorized access to critical data and modify some data. CVSS 7.1 (HIGH). No exploit details provided; remediation ...