CG
Product
Commerce Guided Search
On CISA KEVExploited in the wild
132
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 71Medium 37Low 1
Watch
Add Commerce Guided Search to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-39144 In wildKEV | 8.5 | Aug 23 | XStream is vulnerable to a Remote Command Execution attack Affected: 11.3.2 |
| CVE-2026-61149 | 8.8 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61148 | 8.8 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-39139 | 8.8 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2026-71000 | 8.7 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-70996 | 8.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71002 | 8.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-39150 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling Affected: 11.3.2 |
| CVE-2021-39152 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling Affected: 11.3.2 |
| CVE-2021-39149 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39148 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39147 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39146 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39145 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39141 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39151 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2021-39154 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 11.3.2 |
| CVE-2026-71024 | 8.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge) Affected: 11.4.0 |
| CVE-2026-71018 | 8.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71016 | 8.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-70993 | 8.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2016-5482 | 8.2 | Oct 25 | Unspecified vulnerability in the Oracle Commerce Guided Search component in Oracle Commerce 6.2.2, 6.3.0, 6.4.1.2, and 6.5.0 through 6.5.2 allows remote attackers to affect… Affected: 6.2.2; 6.3.0; 6.4.1.2; 6.5.0; 6.5.1; 6.5.2 |
| CVE-2026-71035 | 8.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge) Affected: 11.4.0 |
| CVE-2026-70999 | 8.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61163 | 8.1 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge) Affected: 11.4.0 |
| CVE-2026-61160 | 8.1 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61150 | 8.1 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-20190 | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 Affected: 11.3.2 |
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: 11.3.2 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 11.3.2 |
| CVE-2026-71028 | 7.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71010 | 7.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 11.3.2 |
| CVE-2026-70988 | 7.7 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-71027 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71022 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench) Affected: 11.4.0 |
| CVE-2026-71021 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71020 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71038 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71034 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge) Affected: 11.4.0 |
| CVE-2026-71023 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-70987 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70986 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70985 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-61159 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61158 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61157 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2022-21466 | 7.5 | Apr 19 | Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks) Affected: 11.3.2 |
| CVE-2021-43859 | 7.5 | Feb 1 | XStream is an open source java library to serialize objects to XML and back again Affected: 11.3.2 |
| CVE-2021-37136 | 7.5 | Oct 19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) Affected: 11.3.2 |