CVE-2020-2604

CVE-2020-2604 affects Oracle Java SE/Java SE Embedded Serialization. Affected: Java SE 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded 8u231. Described impact: unauthenticated, network-based attacker can take over the Java environment; high confidentiality, integrity, and availability impact (CVSS...

CVE-2021-20190

CVE-2021-20190 is a Jackson Databind deserialization vulnerability involving the interaction between serialization gadgets and typing, present in Jackson Databind up to 2.9.10.7. The IBM bulletin for Cloudera Observability confirms this CVE as part of a collection and notes a fix in Cloudera Obse...

CVE-2020-14536

The CVE-2020-14536 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Workbench) with affected versions 11.0, 11.1, 11.2 and prior to 11.3.1. The vulnerability details a difficult-to-exploit issue that allows an unauthenticated attacker, over HTTP, to compromise th...

CVE-2026-71002

Oracle Commerce 11.4.0's Experience Manager component is vulnerable via HTTP; a low-privileged network attacker can modify or delete critical data with scope change (CVSS 8.5). No exploit code is provided. Apply Oracle's August 2026 CPU patches.

CVE-2021-2346

CVE-2021-2346 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Tools and Frameworks) with affected version 11.3.1.5. The vulnerability is exploitable over HTTP by a low-privilege attacker on the network; successful attacks require human interaction and can lead to unaut...

CVE-2021-2345

CVE-2021-2345 affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager (Tools and Frameworks) with a vulnerability in version 11.3.1.5. The issue allows a low-privilege, network-accessible attacker (HTTP) to compromise the product, requiring user interaction, and potentially l...

CVE-2015-0495

CVE-2015-0495 affects Oracle Commerce Platform 3.x and 11.x; vulnerability in the Workbench component of Oracle Commerce Guided Search/Commerce Experience Manager enables remote arbitrary code execution (CNVD-2015-02593) and Oracle Endeca Workbench handling (ZDI-15-146). Root cause centers on vul...

CVE-2021-2348

CVE-2021-2348 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Tools and Frameworks), version 11.3.1.5. The vulnerability allows a low-privileged, network-authenticated attacker to read a subset of data via HTTP, indicating a confidentiality impact. Descriptions across ...

CVE-2026-70984

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated remote attackers to create, delete or modify critical data and cause denial of service via HTTP. CVSS 3.1 score is 9.1 (Critical). No patch version or exploit details are provided; see Oracle's August 2026 CPU advisory for r...

CVE-2026-71033

Oracle Commerce 11.4.0's Endeca Application Controller component is affected by a medium-severity (CVSS 5.5) local vulnerability allowing a low-privileged attacker with infrastructure access to read confidential data; no exploitation evidence or patch details are provided in the documents.

CVE-2026-70998

Oracle Commerce 11.4.0 , specifically the Endeca Application Controller component, is affected by a CRITICAL (CVSS 9.3) vulnerability exploitable by an unauthenticated attacker over HTTP with low complexity. The flaw enables unauthorized access to critical data and update/insert/delete operations...

CVE-2026-61146

CVE-2026-61146 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) with affected version 11.4.0. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the affected product, potentially leading ...

CVE-2026-71023

An unauthenticated, network-reachable flaw in Oracle Commerce 11.4.0's Endeca Application Controller allows arbitrary creation, deletion, or modification of all accessible data (CVSS 7.5, HIGH). No exploitation evidence is provided. Customers should consult Oracle's August 2026 CPU advisory for p...

CVE-2026-70976

CVE-2026-70976 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity and no user interaction to achieve una...

CVE-2026-71014

A critical (CVSS 9.1) unauthenticated HTTP vulnerability in Oracle Commerce 11.4.0's Endeca Application Controller allows remote attackers to read, create, modify, or delete all accessible application data. No root cause or fix version is specified; monitor Oracle's August 2026 security advisory ...

CVE-2026-71016

CVE-2026-71016 affects the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though user interaction is required. Due to a scope ch...

CVE-2026-71030

CVE-2026-71030 affects Oracle Commerce 11.4.0 (Endeca Application Controller component). An unauthenticated attacker can exploit it via HTTP to gain unauthorized read/insert/delete access to data, with potential scope change to other products. CVSS 7.2 HIGH. No exploit details or patch info provi...

CVE-2026-70985

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated, network-based HTTP attacks causing high confidentiality impact (CVSS 7.5). Oracle's August 2026 CPU advisory addresses it; no exploit or root-cause details are provided in the documents.

CVE-2026-71032

Oracle Commerce 11.4.0's Endeca Application Controller has an easily exploitable, unauthenticated HTTP vulnerability allowing unauthorized read, insert, delete, and update access to data, with CVSS 7.2 (HIGH). No patch or exploit details are provided; monitor Oracle's August 2026 CPU advisory for...

CVE-2026-61150

Oracle Commerce Vulnerability CVE-2026-61150 affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component (Experience Manager) in version 11.4.0. The issue allows a low-privileged, network-accessible attacker (HTTP) to compromise data, enabling unauthorized creation, d...

CVE-2026-70979

Oracle Commerce 11.4.0's Content Acquisition System component is affected by a critical (CVSS 9.1) unauthenticated HTTP vulnerability allowing attackers to modify or delete data and cause denial-of-service crashes. No exploit code or patch version is provided in the documents; customers should mo...

CVE-2026-71001

Oracle Commerce Experience Manager component in version 11.4.0 is vulnerable to unauthorized data access: a low-privileged attacker with network HTTP access can read critical data (CVSS 6.5, HIGH confidentiality impact). Oracle's August 2026 CPU advisory addresses this; no specific root cause, pa...

CVE-2026-71010

Oracle Commerce version 11.4.0's Experience Manager component is vulnerable to a HIGH-severity (CVSS 7.8) local exploit requiring infrastructure access and human interaction, enabling unauthenticated attackers to compromise the application with full CIA impact. Oracle has released patches in its ...

CVE-2026-61158

CVE-2026-61158 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) and is applicable to version 11.4.0. The vulnerability can be triggered by an unauthenticated attacker with network access via RMI to compromise the Product, potentially leadi...

CVE-2026-70978

Oracle Commerce 11.4.0's Content Acquisition System component has a critical unauthenticated HTTP vulnerability (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 security advisory is the source for details. No exploitation evidence or specific fix version is ...

CVE-2026-70993

CVE-2026-70993 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can trigger a complete denial-of-service (hang or repeatable crash) and perform unauthori...

CVE-2026-70995

The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...

CVE-2026-70997

Oracle Commerce Experience Manager component in version 11.4.0 is affected by a critical (CVSS 9.1) unauthenticated HTTP-based vulnerability allowing unauthorized access to all accessible data and repeatable denial-of-service crashes. Oracle's August 2026 CPU advisory is the primary reference; no...

CVE-2026-71019

Oracle Commerce 11.4.0's Guided Search / Experience Manager (Internal operations component) allows unauthenticated HTTP attackers to read and modify some data, requiring user interaction. CVSS 6.1 (MEDIUM). Oracle's August 2026 CPU (https://www.oracle.com/security-alerts/cspuaug2026.html) address...

CVE-2026-61159

CVE-2026-61159 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) on version 11.4.0. The issue permits unauthenticated, network‑accessible HTTP access to compromise the product, with impact limited to confidentiality (CVSS 3.1: 7.5). Connect...

CVE-2026-70977

Oracle Commerce 11.4.0 Content Acquisition System is critically vulnerable (CVSS 9.1). An unauthenticated remote attacker can compromise data integrity, cause unauthorized creation/deletion/modification of critical data, and trigger complete denial-of-service. Oracle's August 2026 CPU advisory at...

CVE-2026-70981

Oracle Commerce 11.4.0 Content Acquisition System is affected by a critical (CVSS 9.1) unauthenticated network-based vulnerability enabling unauthorized data modification and denial of service. No exploitation details are provided; refer to Oracle's August 2026 security alert for patch information.

CVE-2026-70987

Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...

CVE-2026-71026

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-based HTTP attack (CVSS 9.1, Critical) enabling full confidentiality and integrity compromise of Commerce Guided Search and Experience Manager data. Oracle's August 2026 CPU advisory is the authori...

CVE-2026-61145

CVE-2026-61145 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) in version 11.4.0. An unauthenticated attacker with network access via HTTP can compromise these components, potentially taking over the Guided Search/Experience Manag...

CVE-2026-61160

CVE-2026-61160 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in 11.4.0. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise the product, potentially leading to unauthorized access to data and a...

CVE-2026-70982

CVE-2026-70982 affects Oracle Commerce 11.4.0's Content Acquisition System component. An unauthenticated, network-accessible attacker can exploit it (high complexity) to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 6.8. Oracle's August 2026 CPU adviso...

CVE-2026-70994

CVE-2026-70994 affects Oracle Commerce Guided Search / Experience Manager version 11.4.0 (component: Endeca Application Controller). An unauthenticated attacker with network HTTP access can read all accessible data (confidentiality) and trigger repeatable crashes (DoS). CVSS 3.1 score 9.1 Critica...

CVE-2026-70996

Oracle Commerce 11.4.0's Endeca Application Controller has an easily exploitable unauthenticated, network-accessible vulnerability (CVSS 8.6 HIGH) allowing unauthorized access to critical or all accessible data; no exploit or patch details are provided. Monitor Oracle's August 2026 security advis...

CVE-2026-70999

Oracle Commerce Experience Manager (affected version 11.4.0) has a high-severity (CVSS 8.1) vulnerability allowing low-privileged network attackers to gain unauthorized read/write access to critical data. No root cause, exploit details, or patch version are provided; monitor Oracle's August 2026 ...

CVE-2026-71027

The vulnerability affects Oracle Commerce 11.4.0, specifically the Endeca Application Controller component. A low-privileged attacker with network HTTP access can exploit it (requiring human interaction) to gain unauthorized read access to critical data and limited write/modify access. CVSS 7.6 (...

CVE-2026-71034

Oracle Commerce 11.4.0 (component: Forge) is vulnerable to an unauthenticated SOAP-based attack via network access. Successful exploitation enables an attacker to gain unauthorized access to critical data or complete access to all accessible Oracle Commerce data, with confidentiality impact rated...

CVE-2026-71035

A HIGH-severity (CVSS 8.1) vulnerability affects Oracle Commerce 11.4.0's Forge component, exploitable by an unauthenticated remote attacker over HTTP with high attack complexity, leading to full compromise of Guided Search/Experience Manager (C/I/A impact). Oracle's August 2026 CPU advisory is t...

CVE-2026-61161

The CVE-2026-61161 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), affected in version 11.4.0. The vulnerability is exploitable over HTTP with network access by an unauthenticated attacker, potentially leading to takeover of the a...

CVE-2026-61162

The CVE-2026-61162 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller) with affected version 11.4.0. The vulnerability allows a low-privilege, logged-in attacker to compromise the system, potentially causing unauthorized creation, deletion or...

CVE-2026-61163

CVE-2026-61163 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) with affected version 11.4.0. The vulnerability is exploitable over the network (HTTP) by an unauthenticated attacker, with attack complexity high and no required privileges, potentially le...

CVE-2026-70983

Oracle Commerce version 11.4.0 Content Acquisition System has a medium-severity (CVSS 6.8) vulnerability exploitable via HTTP by an unauthenticated attacker, enabling unauthorized access to critical data with scope-change impact. No exploitation evidence is present. Refer to Oracle's CSPUAug2026 ...

CVE-2026-71005

Oracle Commerce 11.4.0 Experience Manager component is vulnerable: an unauthenticated remote attacker can exploit it via HTTP (with user interaction) to read and modify data, with scope change affecting additional products. CVSS 6.1 MEDIUM. No exploitation observed; Oracle has released updates. M...

CVE-2026-71015

Oracle Commerce 11.4.0 (Endeca Application Controller) has a critical CVSS 9.1 flaw exploitable by unauthenticated attackers over HTTP, enabling unauthorized data creation, deletion, modification, and full data access; no exploit details are provided, and the Oracle CSP advisory (cspuaug2026.html...

CVE-2026-61149

CVE-2026-61149 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in Oracle Commerce version 11.4.0. The description indicates an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to compromise ...