CVE-2020-2604

CVE-2020-2604 affects Oracle Java SE/Java SE Embedded Serialization. Affected: Java SE 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded 8u231. Described impact: unauthenticated, network-based attacker can take over the Java environment; high confidentiality, integrity, and availability impact (CVSS...

CVE-2021-20190

CVE-2021-20190 is a Jackson Databind deserialization vulnerability involving the interaction between serialization gadgets and typing, present in Jackson Databind up to 2.9.10.7. The IBM bulletin for Cloudera Observability confirms this CVE as part of a collection and notes a fix in Cloudera Obse...

CVE-2020-14536

The CVE-2020-14536 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Workbench) with affected versions 11.0, 11.1, 11.2 and prior to 11.3.1. The vulnerability details a difficult-to-exploit issue that allows an unauthenticated attacker, over HTTP, to compromise th...

CVE-2021-2345

CVE-2021-2345 affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager (Tools and Frameworks) with a vulnerability in version 11.3.1.5. The issue allows a low-privilege, network-accessible attacker (HTTP) to compromise the product, requiring user interaction, and potentially l...

CVE-2026-71002

Oracle Commerce 11.4.0's Experience Manager component is vulnerable via HTTP; a low-privileged network attacker can modify or delete critical data with scope change (CVSS 8.5). No exploit code is provided. Apply Oracle's August 2026 CPU patches.

CVE-2015-0495

CVE-2015-0495 affects Oracle Commerce Platform 3.x and 11.x; vulnerability in the Workbench component of Oracle Commerce Guided Search/Commerce Experience Manager enables remote arbitrary code execution (CNVD-2015-02593) and Oracle Endeca Workbench handling (ZDI-15-146). Root cause centers on vul...

CVE-2021-2346

CVE-2021-2346 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Tools and Frameworks) with affected version 11.3.1.5. The vulnerability is exploitable over HTTP by a low-privilege attacker on the network; successful attacks require human interaction and can lead to unaut...

CVE-2021-2348

CVE-2021-2348 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Tools and Frameworks), version 11.3.1.5. The vulnerability allows a low-privileged, network-authenticated attacker to read a subset of data via HTTP, indicating a confidentiality impact. Descriptions across ...

CVE-2026-71030

CVE-2026-71030 affects Oracle Commerce 11.4.0 (Endeca Application Controller component). An unauthenticated attacker can exploit it via HTTP to gain unauthorized read/insert/delete access to data, with potential scope change to other products. CVSS 7.2 HIGH. No exploit details or patch info provi...

CVE-2026-71010

Oracle Commerce version 11.4.0's Experience Manager component is vulnerable to a HIGH-severity (CVSS 7.8) local exploit requiring infrastructure access and human interaction, enabling unauthenticated attackers to compromise the application with full CIA impact. Oracle has released patches in its ...

CVE-2026-70984

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated remote attackers to create, delete or modify critical data and cause denial of service via HTTP. CVSS 3.1 score is 9.1 (Critical). No patch version or exploit details are provided; see Oracle's August 2026 CPU advisory for r...

CVE-2026-71033

Oracle Commerce 11.4.0's Endeca Application Controller component is affected by a medium-severity (CVSS 5.5) local vulnerability allowing a low-privileged attacker with infrastructure access to read confidential data; no exploitation evidence or patch details are provided in the documents.

CVE-2026-61146

CVE-2026-61146 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) with affected version 11.4.0. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the affected product, potentially leading ...

CVE-2026-70998

Oracle Commerce 11.4.0 , specifically the Endeca Application Controller component, is affected by a CRITICAL (CVSS 9.3) vulnerability exploitable by an unauthenticated attacker over HTTP with low complexity. The flaw enables unauthorized access to critical data and update/insert/delete operations...

CVE-2026-71023

An unauthenticated, network-reachable flaw in Oracle Commerce 11.4.0's Endeca Application Controller allows arbitrary creation, deletion, or modification of all accessible data (CVSS 7.5, HIGH). No exploitation evidence is provided. Customers should consult Oracle's August 2026 CPU advisory for p...

CVE-2026-61150

Oracle Commerce Vulnerability CVE-2026-61150 affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component (Experience Manager) in version 11.4.0. The issue allows a low-privileged, network-accessible attacker (HTTP) to compromise data, enabling unauthorized creation, d...

CVE-2026-70976

CVE-2026-70976 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity and no user interaction to achieve una...

CVE-2026-71014

A critical (CVSS 9.1) unauthenticated HTTP vulnerability in Oracle Commerce 11.4.0's Endeca Application Controller allows remote attackers to read, create, modify, or delete all accessible application data. No root cause or fix version is specified; monitor Oracle's August 2026 security advisory ...

CVE-2026-61160

CVE-2026-61160 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in 11.4.0. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise the product, potentially leading to unauthorized access to data and a...

CVE-2026-71026

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-based HTTP attack (CVSS 9.1, Critical) enabling full confidentiality and integrity compromise of Commerce Guided Search and Experience Manager data. Oracle's August 2026 CPU advisory is the authori...

CVE-2026-71016

CVE-2026-71016 affects the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though user interaction is required. Due to a scope ch...

CVE-2026-70979

Oracle Commerce 11.4.0's Content Acquisition System component is affected by a critical (CVSS 9.1) unauthenticated HTTP vulnerability allowing attackers to modify or delete data and cause denial-of-service crashes. No exploit code or patch version is provided in the documents; customers should mo...

CVE-2026-61145

CVE-2026-61145 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) in version 11.4.0. An unauthenticated attacker with network access via HTTP can compromise these components, potentially taking over the Guided Search/Experience Manag...

CVE-2026-61158

CVE-2026-61158 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) and is applicable to version 11.4.0. The vulnerability can be triggered by an unauthenticated attacker with network access via RMI to compromise the Product, potentially leadi...

CVE-2026-61164

CVE-2026-61164 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System) with affected version 11.4.0. The vulnerability can be exploited by an unauthenticated attacker over HTTPS from network access to compromise data, enabling unauthorized create/de...

CVE-2026-70997

Oracle Commerce Experience Manager component in version 11.4.0 is affected by a critical (CVSS 9.1) unauthenticated HTTP-based vulnerability allowing unauthorized access to all accessible data and repeatable denial-of-service crashes. Oracle's August 2026 CPU advisory is the primary reference; no...

CVE-2026-71019

Oracle Commerce 11.4.0's Guided Search / Experience Manager (Internal operations component) allows unauthenticated HTTP attackers to read and modify some data, requiring user interaction. CVSS 6.1 (MEDIUM). Oracle's August 2026 CPU (https://www.oracle.com/security-alerts/cspuaug2026.html) address...

CVE-2026-71032

Oracle Commerce 11.4.0's Endeca Application Controller has an easily exploitable, unauthenticated HTTP vulnerability allowing unauthorized read, insert, delete, and update access to data, with CVSS 7.2 (HIGH). No patch or exploit details are provided; monitor Oracle's August 2026 CPU advisory for...

CVE-2026-61157

The CVE-2026-61157 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) for version 11.4.0. The vulnerability is exploitable over HTTP by an unauthenticated attacker with network access, potentially leading to unauthorized access to con...

CVE-2026-61159

CVE-2026-61159 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) on version 11.4.0. The issue permits unauthenticated, network‑accessible HTTP access to compromise the product, with impact limited to confidentiality (CVSS 3.1: 7.5). Connect...

CVE-2026-70982

CVE-2026-70982 affects Oracle Commerce 11.4.0's Content Acquisition System component. An unauthenticated, network-accessible attacker can exploit it (high complexity) to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 6.8. Oracle's August 2026 CPU adviso...

CVE-2026-70985

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated, network-based HTTP attacks causing high confidentiality impact (CVSS 7.5). Oracle's August 2026 CPU advisory addresses it; no exploit or root-cause details are provided in the documents.

CVE-2026-70995

The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...

CVE-2026-71027

The vulnerability affects Oracle Commerce 11.4.0, specifically the Endeca Application Controller component. A low-privileged attacker with network HTTP access can exploit it (requiring human interaction) to gain unauthorized read access to critical data and limited write/modify access. CVSS 7.6 (...

CVE-2026-61162

The CVE-2026-61162 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller) with affected version 11.4.0. The vulnerability allows a low-privilege, logged-in attacker to compromise the system, potentially causing unauthorized creation, deletion or...

CVE-2026-61163

CVE-2026-61163 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) with affected version 11.4.0. The vulnerability is exploitable over the network (HTTP) by an unauthenticated attacker, with attack complexity high and no required privileges, potentially le...

CVE-2026-70994

CVE-2026-70994 affects Oracle Commerce Guided Search / Experience Manager version 11.4.0 (component: Endeca Application Controller). An unauthenticated attacker with network HTTP access can read all accessible data (confidentiality) and trigger repeatable crashes (DoS). CVSS 3.1 score 9.1 Critica...

CVE-2026-71035

A HIGH-severity (CVSS 8.1) vulnerability affects Oracle Commerce 11.4.0's Forge component, exploitable by an unauthenticated remote attacker over HTTP with high attack complexity, leading to full compromise of Guided Search/Experience Manager (C/I/A impact). Oracle's August 2026 CPU advisory is t...

CVE-2026-61161

The CVE-2026-61161 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), affected in version 11.4.0. The vulnerability is exploitable over HTTP with network access by an unauthenticated attacker, potentially leading to takeover of the a...

CVE-2026-70993

CVE-2026-70993 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can trigger a complete denial-of-service (hang or repeatable crash) and perform unauthori...

CVE-2026-71001

Oracle Commerce Experience Manager component in version 11.4.0 is vulnerable to unauthorized data access: a low-privileged attacker with network HTTP access can read critical data (CVSS 6.5, HIGH confidentiality impact). Oracle's August 2026 CPU advisory addresses this; no specific root cause, pa...

CVE-2026-71015

Oracle Commerce 11.4.0 (Endeca Application Controller) has a critical CVSS 9.1 flaw exploitable by unauthenticated attackers over HTTP, enabling unauthorized data creation, deletion, modification, and full data access; no exploit details are provided, and the Oracle CSP advisory (cspuaug2026.html...

CVE-2026-61147

The CVE-2026-61147 entry affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System) for product version 11.4.0. The vulnerability allows a local unauthenticated attacker with access to the hosting infrastructure to cause a hang or frequent crash (DoS) ...

CVE-2026-61149

CVE-2026-61149 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in Oracle Commerce version 11.4.0. The description indicates an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to compromise ...

CVE-2026-61153

CVE-2026-61153 impacts Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) with affected version 11.4.0. The vulnerability allows unauthenticated network access via HTTP to compromise the product, enabling unauthorized creation, deletion or modificat...

CVE-2026-70980

Oracle Commerce Platform 11.4.0's Content Acquisition System component contains a critical vulnerability (CVSS 9.0) exploitable by unauthenticated remote attackers over HTTP, enabling full system takeover with scope-change impact on confidentiality, integrity, and availability. Root cause is insu...

CVE-2026-70987

Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...

CVE-2026-71005

Oracle Commerce 11.4.0 Experience Manager component is vulnerable: an unauthenticated remote attacker can exploit it via HTTP (with user interaction) to read and modify data, with scope change affecting additional products. CVSS 6.1 MEDIUM. No exploitation observed; Oracle has released updates. M...

CVE-2026-71017

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-accessible HTTP attack (CVSS 6.5, HIGH complexity). Successful exploitation yields unauthorized access to critical data and partial denial of service. No exploit details are provided; Oracle's Augu...

CVE-2026-70978

Oracle Commerce 11.4.0's Content Acquisition System component has a critical unauthenticated HTTP vulnerability (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 security advisory is the source for details. No exploitation evidence or specific fix version is ...