Commerce Guided Search vulnerabilities

61 known vulnerabilities in Commerce Guided Search from Oracle. 61 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Missing Authentication for Critical Functionality

  CVE-2026-70979Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70978Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Missing Authentication for Critical Functionality

  CVE-2026-70977Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70976Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 7.4 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61164Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentica

• 8.1 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Authentication

  CVE-2026-61163Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with net

• 7.1 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61162Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privile

• 9.8 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61161Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 8.1 High severity

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager…

  CVE-2026-61160Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacke

• 7.5 High severity

  Oracle Commerce Guided Search / Oracle…: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-61159Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 7.5 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61158Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 7.5 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61157Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61153Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 7.1 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61151Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacke

• 8.1 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61150Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacke

• 8.8 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Privilege Management

  CVE-2026-61149Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacke

• 8.8 High severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61148Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacke

• 9.9 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Privilege Management

  CVE-2026-61146Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged

• 9.8 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-61145Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 10.0 Critical severity

  VMware Spring Cloud Gateway Code Injection Exploited

  CVE-2022-22947Mar 3, 2022Spring Cloud GatewayEPSS 98.3%

  In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could all

• 8.5 High severity

  XStream Remote Code Execution Exploited

  CVE-2021-39144Aug 23, 2021X-streamEPSS 98.1%

  XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affect