CG
Product
Commerce Guided Search
On CISA KEVExploited in the wild
132
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 71Medium 37Low 1
Watch
Add Commerce Guided Search to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-70989 | 6.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 11.3.2 |
| CVE-2019-12406 | 6.5 | Nov 6 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message Affected: 11.3.2 |
| CVE-2026-70991 | 6.3 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2021-39140 | 6.3 | Aug 23 | XStream can cause a Denial of Service Affected: 11.3.2 |
| CVE-2026-61147 | 6.2 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System) Affected: 11.4.0 |
| CVE-2026-71031 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71025 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2026-71019 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Internal operations) Affected: 11.4.0 |
| CVE-2026-71011 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71006 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71005 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2026-71004 | 6.1 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2023-22029 | 6.1 | Oct 17 | Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench) Affected: 11.3.2 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 11.3.2 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 11.3.2 |
| CVE-2021-22947 | 5.9 | Sep 29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple… Affected: 11.3.2 |
| CVE-2026-71033 | 5.5 | Aug 18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller) Affected: 11.4.0 |
| CVE-2022-22946 | 5.5 | Mar 4 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an… Affected: 11.3.2 |
| CVE-2026-61152 | 5.4 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager) Affected: 11.4.0 |
| CVE-2021-41165 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 11.3.2 |
| CVE-2021-41164 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 11.3.2 |
| CVE-2021-37695 | 5.4 | Aug 13 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: 11.3.2 |
| CVE-2021-32809 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: 11.3.2 |
| CVE-2021-32808 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: 11.3.2 |
| CVE-2021-2346 | 5.4 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks) Affected: 11.3.1.5 |
| CVE-2021-2345 | 5.4 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks) Affected: 11.3.1.5 |
| CVE-2020-13956 | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… Affected: 11.3.2 |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 11.3.2 |
| CVE-2021-2348 | 4.3 | Jul 21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks) Affected: 11.3.1.5 |
| CVE-2020-8908 | 3.3 | Dec 10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory… Affected: 11.3.2 |
| CVE-2015-0495 | – | Apr 16 | Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to… Affected: All versions, or not specified |