Commerce Guided Search

Remote unauthenticated access to the Forge component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows network-based attackers to read all data accessible to the platform and inflict partial denial of service via ordinary HTTP requests. The CVSS vector confirms no authentication, user interaction, or special configuration is required, placing this firmly in the automatable, high-priority tier. No public exploit has been identified at time of analysis, but the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.

Unauthenticated remote data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Endeca Application Controller to attackers who can create, delete, or modify critical commerce data over HTTP with no credentials required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's own characterization of the flaw as 'easily exploitable' confirm a low-barrier attack path with high integrity impact. No public exploit and no CISA KEV listing are identified at time of analysis, though the authentication bypass tag signals a fundamental access control failure in the controller interface.

The Workbench component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a network-exploitable flaw that allows a low-privileged authenticated attacker to compromise confidentiality across a changed scope, affecting additional Oracle Commerce products beyond the directly targeted component. Successful exploitation yields unauthorized access to critical or complete Commerce-accessible data and limited write capability, contingent on a victim user interacting with attacker-controlled content. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle disclosed this via the August 2026 Critical Patch Update.

Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a network-accessible, low-privileged authenticated attacker to compromise the Endeca Application Controller through HTTP, provided a victim user interacts with attacker-controlled content. The vulnerability carries a scope change, meaning successful exploitation can cascade to affect additional Oracle Commerce components beyond the directly targeted product, resulting in high confidentiality impact and limited integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor-tagged 'Authentication Bypass' nature elevates practical concern for multi-tenant or externally accessible deployments.

Unauthorized data access and limited data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is achievable by a low-privileged network attacker who can induce a victim user to interact with a crafted HTTP request targeting the Endeca Application Controller component. Successful exploitation causes a scope change, meaning the impact extends beyond the directly targeted application to additional Oracle Commerce products, enabling high-confidentiality data exposure and limited unauthorized data modification. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the combination of low attack complexity and scope change elevates the practical business risk.

Cross-site scripting in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise victim sessions via HTTP. The attack requires human interaction - a victim must trigger the malicious request - and exploits the Internal operations component in a way that causes a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself (consistent with browser-context hijacking). Impact is limited to partial confidentiality and integrity loss: unauthorized read access to a subset of accessible data and unauthorized write/insert/delete on some accessible data; no availability impact is present. No public exploit or CISA KEV listing has been identified at time of analysis.

Remote exploitation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows unauthenticated network attackers to achieve a scope change, compromising confidentiality of all data accessible to the Oracle Commerce platform and enabling limited unauthorized data modification. The attack requires victim interaction, suggesting a client-side exploitation vector such as cross-site scripting or cross-site request forgery that bypasses authentication controls per the advisory's Authentication Bypass tag. Disclosed under the Oracle August 2026 Critical Patch Update with a CVSS 8.2 High rating; no public exploit or active exploitation confirmed at time of analysis.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.

Unauthenticated remote attackers can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP by exploiting an authentication bypass in the Endeca Application Controller component, with successful attacks requiring human interaction from a victim user. Exploitation yields complete read access to all data accessible by the Oracle Commerce application (C:H) and limited write capability (I:L), with a confirmed scope change meaning additional Oracle Commerce platform components beyond the targeted instance can be significantly impacted. Oracle characterizes this as easily exploitable in its August 2026 Critical Security Patch Update advisory; no public exploit has been identified at time of analysis.

Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a strong patching priority.

Unauthorized data read and write against Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via its Endeca Application Controller, which a remote unauthenticated attacker can reach over HTTP. The flaw, disclosed by Oracle and tagged as an authentication bypass, yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact, meaning an attacker can create, delete, or modify critical Endeca data or read all accessible data without any credentials. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a strong patching priority.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes a network-accessible flaw allowing low-privileged authenticated attackers via HTTP to read critical or all accessible application data and cause partial availability disruption. The CVSS 3.1 score of 7.1 reflects high confidentiality impact combined with low availability impact, with no integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting (XSS) class vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to compromise confidentiality and integrity of data by delivering a crafted HTTP payload that requires victim interaction. The scope change indicator in the CVSS vector (S:C) confirms that successful exploitation impacts resources beyond the directly vulnerable component - consistent with browser-context script execution affecting adjacent systems or sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this accessible to unsophisticated attackers once a suitable delivery mechanism is established.

Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a local, unauthenticated attacker who can engineer human interaction from a legitimate user on the same infrastructure. Disclosed in Oracle's August 2026 Critical Security Patch Update, the vulnerability results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and no proof-of-concept is known to exist.

Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. Successful exploitation yields unauthorized read and write access to all data accessible by the application. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.

Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.

Cross-site scripting (XSS) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a remote unauthenticated attacker to inject malicious content into a victim's browser session via a crafted HTTP request, requiring the victim to interact with a manipulated link or page. The scope change in the CVSS vector (S:C) indicates the attack can affect browser context outside the vulnerable component, enabling session token theft or unauthorized data modification within the application. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting or client-side injection in Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise confidentiality and integrity of affected deployments through HTTP-delivered attacks requiring victim interaction. The scope change indicator in the CVSS vector confirms that successful exploitation can impact resources beyond the directly vulnerable component, consistent with session theft or content injection affecting downstream users. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this in a quarterly advisory cycle.

Cross-site scripting conditions in Oracle Commerce Guided Search / Experience Manager 11.4.0 allow an unauthenticated remote attacker to compromise victim sessions through a crafted HTTP request that requires human interaction to trigger. The vulnerability carries a scope change, extending impact beyond the directly vulnerable component to data accessible within the victim's authenticated browser context, enabling unauthorized read and limited data modification. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified at the time of analysis.

Oracle Commerce Experience Manager 11.4.0 exposes a network-accessible flaw in its Experience Manager component that permits low-privileged authenticated attackers to gain complete unauthorized access to all platform data and cause partial availability degradation via HTTP. The CVSS 3.1 score of 7.1 reflects high confidentiality impact with no integrity exposure, consistent with an authorization bypass or excessive data access pattern rather than code execution. No public exploit or CISA KEV listing exists at time of analysis; however, the intelligence tag 'Authentication Bypass' introduces a discrepancy with the PR:L metric that warrants verification against the full Oracle advisory.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is affected by a network-exploitable vulnerability that allows low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a scope change, meaning successful exploitation can significantly impact systems beyond the directly targeted component. Tagged as an authentication bypass, this flaw is exploitable over HTTP without user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthorized data disclosure in Oracle Commerce Experience Manager 11.4.0 allows low-privileged authenticated attackers to access critical or complete application data via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that despite requiring a low-privileged account, the flaw circumvents authorization controls that should restrict data access within the Experience Manager component. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit once an attacker has any valid credential.

Unauthorized data access and manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged, network-based attacker who can induce a user interaction from another party - consistent with a stored injection or cross-session exploitation pattern. Successful exploitation produces a scope change, meaning impact propagates beyond the directly vulnerable component to additional Oracle Commerce subsystems, with both confidentiality and integrity fully compromised. No public exploit code has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.

Oracle Commerce Guided Search and Experience Manager 11.4.0 exposes a high-severity authorization bypass over HTTP that allows any low-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of commerce data. The 'Authentication Bypass' tag combined with a PR:L vector indicates that authenticated users with minimal permissions can escalate access to read or manipulate all data accessible to the application, including potentially sensitive customer, catalog, and configuration data. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle has released a fix through the August 2026 Critical Patch Update.

Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), version 11.4.0, lets a remote attacker reach the application over HTTP without credentials and read critical data while also tampering with a subset of it. Because the flaw carries a scope change, successful exploitation can reach beyond the vulnerable component and affect additional products in the deployment. Oracle rates it CVSS 3.1 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read all data accessible to the Experience Manager component and force a repeatable crash or hang. The flaw is tagged as an authentication bypass, carries a CVSS 3.1 base score of 9.1, and is reachable over HTTP with no credentials or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated remote information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network attackers to retrieve critical data or gain complete read access to all data accessible through the Endeca Application Controller via HTTP. The CVSS vector confirms a zero-complexity, no-privilege, no-interaction attack path with scope change, meaning successful exploitation cascades beyond the directly targeted component to affect additional Oracle Commerce products. No public exploit code or CISA KEV listing exists at time of analysis, though the authentication bypass classification and high-severity confidentiality impact make this a material risk for any internet-exposed deployment.

Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which is reachable over HTTP by unauthenticated network attackers. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, meaning a single crafted request can yield full control of the search/merchandising tier. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item disclosed in Oracle's August 2026 Critical Patch Update.

Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated vector make it a high-priority patch.

Unauthenticated denial-of-service and partial data integrity compromise in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Content Acquisition System component to remote HTTP exploitation. An attacker with network access can repeatedly crash or hang the service and perform unauthorized data manipulation (insert, update, or delete) against accessible data stores. No public exploit code has been identified at time of analysis, and Oracle disclosed this in the August 2026 Critical Patch Update.

Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged local attacker through the Content Acquisition System component. Exploitation requires physical or logical access to the host infrastructure combined with high attack complexity, constraining the realistic threat to insider actors or adversaries who have already established a foothold on the target server. No public exploit code has been identified and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Oracle Commerce Guided Search and Experience Manager version 11.4.0 exposes a local confidentiality vulnerability in its Content Acquisition System (CAS) component that allows an unauthenticated infrastructure-level attacker to bypass application-layer authentication and obtain complete read access to all Oracle Commerce accessible data, including critical confidential records. The scope change designation in the CVSS vector (S:C) indicates successful exploitation can cascade beyond the Commerce platform itself, impacting additional co-located or integrated products. No public exploit code has been identified at time of analysis, and EPSS data was not provided in the source intelligence.

Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.

Local data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged attacker with OS-level logon access to the hosting infrastructure to compromise the Content Acquisition System (CAS) component and read critical or complete data. The scope change (S:C) in the CVSS vector confirms the attack can propagate beyond the directly vulnerable component to impact other Oracle Commerce products sharing the same environment. No public exploit code and no CISA KEV listing are identified at time of analysis; this issue was disclosed by Oracle via the August 2026 Critical Patch Update.

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes complete confidentiality of application-accessible data to low-privileged, network-authenticated attackers via HTTP. The vulnerability resides in the Content Acquisition System component and carries a scope-change classification, meaning successful exploitation can extend impact beyond the directly targeted system to affect additional Oracle Commerce components. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad network accessibility make this a credible priority for organizations running the affected version.

Unauthenticated remote data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network-accessible attackers to obtain complete access to all data managed by the platform via HTTP, with no credentials or user interaction required. The vulnerability resides in the Content Acquisition System component and is tagged as an authentication bypass, meaning access controls protecting sensitive commerce data can be circumvented entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial CVSS attack complexity and zero prerequisite conditions make this a priority patch target for any exposed instance.

Unauthenticated remote access to all confidential data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System (CAS) component over HTTP. The vulnerability, tagged as an authentication bypass, requires no privileges and no user interaction, making it easily exploitable by any network-adjacent attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and complete confidentiality impact make this a significant exposure for any deployment with CAS reachable from untrusted networks.

Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, modify, or delete all application-accessible data and force a complete, repeatable crash of the service. Oracle rates it CVSS 3.1 9.1 with High Integrity and High Availability impact and no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the low attack complexity (AC:L) and lack of authentication make it a high-priority patch despite no confirmed exploitation.

Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.

Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, delete, or modify critical data and force a complete, repeatable crash of the platform. Rated CVSS 3.1 9.1 with no authentication or user interaction required, it affects the Endeca-derived search and merchandising layer of Oracle's commerce stack. No public exploit identified at time of analysis, and it is not listed in CISA KEV; confidentiality is explicitly unaffected (C:N), so the danger is integrity and availability rather than data theft.

Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. Oracle rates the flaw 9.0 but explicitly marks it difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.

Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.

Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.

Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.

Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.

Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.

Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.

Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.

Denial-of-service via the Content Acquisition System component in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows any local user already logged onto the host infrastructure to crash or hang the application without requiring elevated OS privileges. Disclosed in Oracle's July 2026 Critical Patch Update, the CVSS 3.1 score of 6.2 (Medium) reflects the local-only attack vector, which substantially constrains exposure to insider threats or attackers who have already achieved OS-level foothold. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privileged attacker reaches the Content Acquisition System component over HTTP. Oracle rates this 9.9 with a scope change (S:C), meaning a successful compromise of the Guided Search product can significantly impact additional downstream products beyond the vulnerable component itself. There is no public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch item.

Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.

XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.