CG
Product
Commerce Guided Search
On CISA KEVExploited in the wild
132
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 71Medium 37Low 1
Watch
Add Commerce Guided Search to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: 11.3.2 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 11.3.2 |
| CVE-2026-71028 | 7.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71010 | 7.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 11.3.2 |
| CVE-2026-70988 | 7.7 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-71027 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71022 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench) Affected: 11.4.0 |
| CVE-2026-71021 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71020 | 7.6 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71038 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71034 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge) Affected: 11.4.0 |
| CVE-2026-71023 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-70987 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70986 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70985 | 7.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-61159 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61158 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61157 | 7.5 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2022-21466 | 7.5 | Apr 19 | Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks) Affected: 11.3.2 |
| CVE-2021-43859 | 7.5 | Feb 1 | XStream is an open source java library to serialize objects to XML and back again Affected: 11.3.2 |
| CVE-2021-37136 | 7.5 | Oct 19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) Affected: 11.3.2 |
| CVE-2021-37137 | 7.5 | Oct 19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage Affected: 11.3.2 |
| CVE-2021-22946 | 7.5 | Sep 29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line… Affected: 11.3.2 |
| CVE-2021-40690 | 7.5 | Sep 19 | Bypass of the secureValidation property Affected: 11.3.2 |
| CVE-2021-35516 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 11.3.2 |
| CVE-2021-35515 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 11.3.2 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 11.3.2 |
| CVE-2021-35517 | 7.5 | Jul 13 | Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Affected: 11.3.2 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: 11.3.2 |
| CVE-2019-12423 | 7.5 | Jan 16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens… Affected: 11.3.2 |
| CVE-2026-71009 | 7.4 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61164 | 7.4 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: 11.3.2 |
| CVE-2020-14536 | 7.4 | Jul 15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench) Affected: 11.0 before 11.3.1 |
| CVE-2026-71032 | 7.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71030 | 7.2 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2020-7712 | 7.2 | Aug 30 | Command Injection Affected: 11.3.2 |
| CVE-2026-71012 | 7.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71003 | 7.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-61162 | 7.1 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-61151 | 7.1 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-70992 | 7.0 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-71008 | 6.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71007 | 6.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-70990 | 6.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70983 | 6.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-70982 | 6.8 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-71017 | 6.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71001 | 6.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |