Oracle Commerce Guided Search / Oracle Commerce Experience Manager vulnerabilities

48 known CVE vulnerabilities in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, translated and rated.

CVE-2017-3572High
A vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component allows an unauthenticated attacker with network access via HTTP to remotely hang or frequently crash the system. Affected versions are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1, and 6.5.2.
CVE-2026-71037Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. User interaction is required. CVSS score is 9.3.
CVE-2026-71036Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
CVE-2026-71026Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
CVE-2026-71015Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
CVE-2026-71014Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
CVE-2026-70998Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and modify some data. The attack may impact additional products. CVSS score is 9.3.
CVE-2026-61161Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can take over the system via HTTP.
CVE-2026-61153Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) allows an unauthenticated attacker via HTTP to unauthorizedly create, delete, or modify critical data and gain full access to all data.
CVE-2026-61146Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) allows a low-privileged attacker with network access via HTTP to compromise the product. Attacks may impact additional products (scope change). CVSS 9.9.
CVE-2026-61145Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can take over the system via HTTP.
CVE-2026-71038High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all accessible data, impacting confidentiality.
CVE-2026-71035High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. An unauthenticated attacker via HTTP can compromise the system, but exploitation is difficult.
CVE-2026-71034High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. An unauthenticated attacker via SOAP can gain unauthorized access to critical data or all accessible data, impacting confidentiality.
CVE-2026-71033Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. A low-privileged attacker with local access can gain unauthorized access to critical data or all accessible data.
CVE-2026-71032High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker via HTTP can update, insert, or delete data and read a subset of data. Attacks may impact additional products (scope change).
CVE-2026-71031Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker via HTTP with user interaction can modify, insert, or delete some data and read a subset of data. Attacks may impact additional products (scope change).
CVE-2026-71030High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can compromise data integrity and confidentiality via HTTP, potentially affecting other products.
CVE-2026-71028High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. A low-privileged attacker with local access can fully compromise the system.
CVE-2026-71027High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. A low-privileged attacker with network access can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-71025Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker via HTTP with user interaction can modify, insert, or delete some data and read a subset of data. Attacks may impact additional products (scope change).
CVE-2026-71024High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. An unauthenticated attacker can gain full access to data and cause partial denial of service.
CVE-2026-71023High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can create, delete, or modify critical data.
CVE-2026-71022High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Workbench) version 11.4.0. A low-privileged attacker with network access can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-71021High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. A low-privileged attacker with network access can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-71020High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. A low-privileged attacker with network access can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-71019Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Internal operations) version 11.4.0. An unauthenticated attacker via HTTP with user interaction can modify, insert, or delete some data and read a subset of data. Attacks may impact additional products (scope change).
CVE-2026-71018High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-71017Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all accessible data and cause partial denial of service.
CVE-2026-71016High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can, with user interaction, access and modify critical data, affecting other products.
CVE-2026-70999High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can compromise data confidentiality and integrity via HTTP, including unauthorized access to or modification of critical data.
CVE-2026-70996High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP, with potential scope change affecting other products.
CVE-2026-70993High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can cause system hang or frequent crashes (complete DoS) and unauthorized modification of some data via HTTP.
CVE-2026-70992High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. A low-privileged attacker with local access can take over the system, but exploitation is difficult.
CVE-2026-70988High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. A low-privileged attacker can gain unauthorized access to critical data via HTTP, with potential scope change affecting other products.
CVE-2026-70987High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP.
CVE-2026-70986High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP.
CVE-2026-70985High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP.
CVE-2026-70983Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, Content Acquisition System component. Affects version 11.4.0. Difficult to exploit, allows unauthenticated attacker via HTTP to gain unauthorized access to critical data or complete access to all product data. May impact other products (scope change).
CVE-2026-70982Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, Content Acquisition System component. Affects version 11.4.0. Difficult to exploit, allows unauthenticated attacker via HTTP to gain unauthorized access to critical data or complete access to all product data. May impact other products (scope change).
CVE-2026-61164High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. Difficult to exploit, allows an unauthenticated attacker via HTTPS to gain unauthorized access and modify critical data.
CVE-2026-61163High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) version 11.4.0. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
CVE-2026-61159High
In Oracle Commerce Guided Search / Experience Manager version 11.4.0, an unauthenticated attacker can remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
CVE-2026-61152Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) version 11.4.0. Low-privileged attacker via HTTP can unauthorizedly read and modify data.
CVE-2026-61151High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager). Affects version 11.4.0. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes of some data. CVSS 7.1 (Confidentiality and Integrity impacts).
CVE-2026-61150High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager). A low-privileged attacker via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.
CVE-2026-61149High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. Allows a low-privileged attacker with network access via HTTP to take over the system.
CVE-2026-61147Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker with local access can cause a complete denial of service (DOS).