Oracle Commerce Guided Search vulnerabilities

132 CVEs affecting Oracle Commerce Guided Search, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71038, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability, published 2022-03-03. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2022-05-16. EPSS: 98.3% chance of exploitation in the next 30 days. In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote…
CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2020-13935, published 2020-07-14. High severity, CVSS 7.5. EPSS: 86.6% chance of exploitation in the next 30 days. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2021-39141, published 2021-08-23. High severity, CVSS 8.5. EPSS: 16.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39146, published 2021-08-23. High severity, CVSS 8.5. EPSS: 14.3% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2019-12419, published 2019-11-06. Critical severity, CVSS 9.8. EPSS: 13.8% chance of exploitation in the next 30 days. Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…

Latest

CVE-2026-71038, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0.…
CVE-2026-71037, published 2026-08-18. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0.…
CVE-2026-71036, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0.…
CVE-2026-71035, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to…
CVE-2026-71034, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily…
CVE-2026-71033, published 2026-08-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71032, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71031, published 2026-08-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71030, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71028, published 2026-08-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…