CVE-2021-2345

CVE-2021-2345 affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager (Tools and Frameworks) with a vulnerability in version 11.3.1.5. The issue allows a low-privilege, network-accessible attacker (HTTP) to compromise the product, requiring user interaction, and potentially l...

CVE-2015-0495

CVE-2015-0495 affects Oracle Commerce Platform 3.x and 11.x; vulnerability in the Workbench component of Oracle Commerce Guided Search/Commerce Experience Manager enables remote arbitrary code execution (CNVD-2015-02593) and Oracle Endeca Workbench handling (ZDI-15-146). Root cause centers on vul...

CVE-2021-2348

CVE-2021-2348 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Tools and Frameworks), version 11.3.1.5. The vulnerability allows a low-privileged, network-authenticated attacker to read a subset of data via HTTP, indicating a confidentiality impact. Descriptions across ...

CVE-2023-22029

Oracle Commerce Guided Search (Workbench) vulnerability tracked as CVE-2023-22029 affects version 11.3.2. The issue stems from insufficient input validation in the Workbench component, allowing an unauthenticated attacker with network access over HTTP to compromise the product. Attacks require us...

CVE-2016-5482

CVE-2016-5482 affects the Oracle Commerce Guided Search component in Oracle Commerce 6.2.2, 6.3.0, 6.4.1.2, and 6.5.0 through 6.5.2. The vulnerability is described as unspecified, with remote attackers able to impact confidentiality and integrity via unknown vectors. The connected documents do no...

CVE-2026-71033

Oracle Commerce 11.4.0's Endeca Application Controller component is affected by a medium-severity (CVSS 5.5) local vulnerability allowing a low-privileged attacker with infrastructure access to read confidential data; no exploitation evidence or patch details are provided in the documents.

CVE-2026-70998

Oracle Commerce 11.4.0 , specifically the Endeca Application Controller component, is affected by a CRITICAL (CVSS 9.3) vulnerability exploitable by an unauthenticated attacker over HTTP with low complexity. The flaw enables unauthorized access to critical data and update/insert/delete operations...

CVE-2026-61146

CVE-2026-61146 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) with affected version 11.4.0. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the affected product, potentially leading ...

CVE-2026-70984

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated remote attackers to create, delete or modify critical data and cause denial of service via HTTP. CVSS 3.1 score is 9.1 (Critical). No patch version or exploit details are provided; see Oracle's August 2026 CPU advisory for r...

CVE-2026-71023

An unauthenticated, network-reachable flaw in Oracle Commerce 11.4.0's Endeca Application Controller allows arbitrary creation, deletion, or modification of all accessible data (CVSS 7.5, HIGH). No exploitation evidence is provided. Customers should consult Oracle's August 2026 CPU advisory for p...

CVE-2026-70976

CVE-2026-70976 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity and no user interaction to achieve una...

CVE-2026-71014

A critical (CVSS 9.1) unauthenticated HTTP vulnerability in Oracle Commerce 11.4.0's Endeca Application Controller allows remote attackers to read, create, modify, or delete all accessible application data. No root cause or fix version is specified; monitor Oracle's August 2026 security advisory ...

CVE-2026-71016

CVE-2026-71016 affects the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though user interaction is required. Due to a scope ch...

CVE-2026-61150

Oracle Commerce Vulnerability CVE-2026-61150 affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component (Experience Manager) in version 11.4.0. The issue allows a low-privileged, network-accessible attacker (HTTP) to compromise data, enabling unauthorized creation, d...

CVE-2026-61158

CVE-2026-61158 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) and is applicable to version 11.4.0. The vulnerability can be triggered by an unauthenticated attacker with network access via RMI to compromise the Product, potentially leadi...

CVE-2026-70979

Oracle Commerce 11.4.0's Content Acquisition System component is affected by a critical (CVSS 9.1) unauthenticated HTTP vulnerability allowing attackers to modify or delete data and cause denial-of-service crashes. No exploit code or patch version is provided in the documents; customers should mo...

CVE-2026-70985

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated, network-based HTTP attacks causing high confidentiality impact (CVSS 7.5). Oracle's August 2026 CPU advisory addresses it; no exploit or root-cause details are provided in the documents.

CVE-2026-71010

Oracle Commerce version 11.4.0's Experience Manager component is vulnerable to a HIGH-severity (CVSS 7.8) local exploit requiring infrastructure access and human interaction, enabling unauthenticated attackers to compromise the application with full CIA impact. Oracle has released patches in its ...

CVE-2026-71032

Oracle Commerce 11.4.0's Endeca Application Controller has an easily exploitable, unauthenticated HTTP vulnerability allowing unauthorized read, insert, delete, and update access to data, with CVSS 7.2 (HIGH). No patch or exploit details are provided; monitor Oracle's August 2026 CPU advisory for...

CVE-2026-70995

The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...

CVE-2026-61145

CVE-2026-61145 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) in version 11.4.0. An unauthenticated attacker with network access via HTTP can compromise these components, potentially taking over the Guided Search/Experience Manag...

CVE-2026-61159

CVE-2026-61159 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) on version 11.4.0. The issue permits unauthenticated, network‑accessible HTTP access to compromise the product, with impact limited to confidentiality (CVSS 3.1: 7.5). Connect...

CVE-2026-61160

CVE-2026-61160 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in 11.4.0. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise the product, potentially leading to unauthorized access to data and a...

CVE-2026-70977

Oracle Commerce 11.4.0 Content Acquisition System is critically vulnerable (CVSS 9.1). An unauthenticated remote attacker can compromise data integrity, cause unauthorized creation/deletion/modification of critical data, and trigger complete denial-of-service. Oracle's August 2026 CPU advisory at...

CVE-2026-70978

Oracle Commerce 11.4.0's Content Acquisition System component has a critical unauthenticated HTTP vulnerability (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 security advisory is the source for details. No exploitation evidence or specific fix version is ...

CVE-2026-70987

Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...

CVE-2026-70993

CVE-2026-70993 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can trigger a complete denial-of-service (hang or repeatable crash) and perform unauthori...

CVE-2026-70997

Oracle Commerce Experience Manager component in version 11.4.0 is affected by a critical (CVSS 9.1) unauthenticated HTTP-based vulnerability allowing unauthorized access to all accessible data and repeatable denial-of-service crashes. Oracle's August 2026 CPU advisory is the primary reference; no...

CVE-2026-71019

Oracle Commerce 11.4.0's Guided Search / Experience Manager (Internal operations component) allows unauthenticated HTTP attackers to read and modify some data, requiring user interaction. CVSS 6.1 (MEDIUM). Oracle's August 2026 CPU (https://www.oracle.com/security-alerts/cspuaug2026.html) address...

CVE-2026-71026

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-based HTTP attack (CVSS 9.1, Critical) enabling full confidentiality and integrity compromise of Commerce Guided Search and Experience Manager data. Oracle's August 2026 CPU advisory is the authori...

CVE-2026-71030

CVE-2026-71030 affects Oracle Commerce 11.4.0 (Endeca Application Controller component). An unauthenticated attacker can exploit it via HTTP to gain unauthorized read/insert/delete access to data, with potential scope change to other products. CVSS 7.2 HIGH. No exploit details or patch info provi...

CVE-2026-61161

The CVE-2026-61161 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), affected in version 11.4.0. The vulnerability is exploitable over HTTP with network access by an unauthenticated attacker, potentially leading to takeover of the a...

CVE-2026-61163

CVE-2026-61163 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) with affected version 11.4.0. The vulnerability is exploitable over the network (HTTP) by an unauthenticated attacker, with attack complexity high and no required privileges, potentially le...

CVE-2026-70981

Oracle Commerce 11.4.0 Content Acquisition System is affected by a critical (CVSS 9.1) unauthenticated network-based vulnerability enabling unauthorized data modification and denial of service. No exploitation details are provided; refer to Oracle's August 2026 security alert for patch information.

CVE-2026-70994

CVE-2026-70994 affects Oracle Commerce Guided Search / Experience Manager version 11.4.0 (component: Endeca Application Controller). An unauthenticated attacker with network HTTP access can read all accessible data (confidentiality) and trigger repeatable crashes (DoS). CVSS 3.1 score 9.1 Critica...

CVE-2026-70996

Oracle Commerce 11.4.0's Endeca Application Controller has an easily exploitable unauthenticated, network-accessible vulnerability (CVSS 8.6 HIGH) allowing unauthorized access to critical or all accessible data; no exploit or patch details are provided. Monitor Oracle's August 2026 security advis...

CVE-2026-71001

Oracle Commerce Experience Manager component in version 11.4.0 is vulnerable to unauthorized data access: a low-privileged attacker with network HTTP access can read critical data (CVSS 6.5, HIGH confidentiality impact). Oracle's August 2026 CPU advisory addresses this; no specific root cause, pa...

CVE-2026-61149

CVE-2026-61149 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) in Oracle Commerce version 11.4.0. The description indicates an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to compromise ...

CVE-2026-61153

CVE-2026-61153 impacts Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) with affected version 11.4.0. The vulnerability allows unauthenticated network access via HTTP to compromise the product, enabling unauthorized creation, deletion or modificat...

CVE-2026-61162

The CVE-2026-61162 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller) with affected version 11.4.0. The vulnerability allows a low-privilege, logged-in attacker to compromise the system, potentially causing unauthorized creation, deletion or...

CVE-2026-61164

CVE-2026-61164 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System) with affected version 11.4.0. The vulnerability can be exploited by an unauthenticated attacker over HTTPS from network access to compromise data, enabling unauthorized create/de...

CVE-2026-70982

CVE-2026-70982 affects Oracle Commerce 11.4.0's Content Acquisition System component. An unauthenticated, network-accessible attacker can exploit it (high complexity) to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 6.8. Oracle's August 2026 CPU adviso...

CVE-2026-70983

Oracle Commerce version 11.4.0 Content Acquisition System has a medium-severity (CVSS 6.8) vulnerability exploitable via HTTP by an unauthenticated attacker, enabling unauthorized access to critical data with scope-change impact. No exploitation evidence is present. Refer to Oracle's CSPUAug2026 ...

CVE-2026-71034

Oracle Commerce 11.4.0 (component: Forge) is vulnerable to an unauthenticated SOAP-based attack via network access. Successful exploitation enables an attacker to gain unauthorized access to critical data or complete access to all accessible Oracle Commerce data, with confidentiality impact rated...

CVE-2026-61157

The CVE-2026-61157 entry concerns Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) for version 11.4.0. The vulnerability is exploitable over HTTP by an unauthenticated attacker with network access, potentially leading to unauthorized access to con...

CVE-2026-70999

Oracle Commerce Experience Manager (affected version 11.4.0) has a high-severity (CVSS 8.1) vulnerability allowing low-privileged network attackers to gain unauthorized read/write access to critical data. No root cause, exploit details, or patch version are provided; monitor Oracle's August 2026 ...

CVE-2026-71005

Oracle Commerce 11.4.0 Experience Manager component is vulnerable: an unauthenticated remote attacker can exploit it via HTTP (with user interaction) to read and modify data, with scope change affecting additional products. CVSS 6.1 MEDIUM. No exploitation observed; Oracle has released updates. M...

CVE-2026-71027

The vulnerability affects Oracle Commerce 11.4.0, specifically the Endeca Application Controller component. A low-privileged attacker with network HTTP access can exploit it (requiring human interaction) to gain unauthorized read access to critical data and limited write/modify access. CVSS 7.6 (...

CVE-2026-61147

The CVE-2026-61147 entry affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System) for product version 11.4.0. The vulnerability allows a local unauthenticated attacker with access to the hosting infrastructure to cause a hang or frequent crash (DoS) ...

CVE-2026-70980

Oracle Commerce Platform 11.4.0's Content Acquisition System component contains a critical vulnerability (CVSS 9.0) exploitable by unauthenticated remote attackers over HTTP, enabling full system takeover with scope-change impact on confidentiality, integrity, and availability. Root cause is insu...