Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

44 records

Vendor: Oracle Component: Commerce Platform Clear all filters
TI-2026-49648 CVE-2026-70955 · GHSA-7xjr-c59j-f76q

Improper access control in Oracle Commerce Platform

Priority LOW 35

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00331 Published 2026-08-18 No fix listed CWE-284
TI-2026-49647 CVE-2026-70954 · GHSA-86j4-hv26-f6v3

Missing authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-08-18 No fix listed CWE-306
TI-2026-49646 CVE-2026-70953 · GHSA-r96c-fqgg-hpcp

Missing authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-08-18 No fix listed CWE-306
TI-2026-43781 CVE-2026-61137 · GHSA-hph8-qr89-f778

Improper authentication in Oracle Commerce Platform

Priority LOW 37

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00392 Published 2026-07-21 No fix listed CWE-287
TI-2026-43780 CVE-2026-61136 · GHSA-q3qp-4hq5-mr52

Improper access control in Oracle Commerce Platform

Priority LOW 38

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00307 Published 2026-07-21 No fix listed CWE-284
TI-2026-43779 CVE-2026-61135 · GHSA-49rr-39cq-x5ph

Improper access control in Oracle Commerce Platform

Priority LOW 34

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0034 Published 2026-07-21 No fix listed CWE-284
TI-2026-43778 CVE-2026-61134 · GHSA-cjjj-jp55-4rff

Improper access control in Oracle Commerce Platform

Priority LOW 32

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00289 Published 2026-07-21 No fix listed CWE-284
TI-2026-43777 CVE-2026-61133 · GHSA-vrp3-w3m3-9r2x

Information disclosure in Oracle Commerce Platform

Priority LOW 39

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00437 Published 2026-07-21 No fix listed CWE-200
TI-2026-43776 CVE-2026-61132 · GHSA-g453-8pp2-93m3

Cross-site request forgery in Oracle Commerce Platform

Priority LOW 32

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00154 Published 2026-07-21 No fix listed CWE-352
TI-2026-43775 CVE-2026-61131 · GHSA-vqg7-q7mc-xx67

Improper access control in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-284
TI-2026-43774 CVE-2026-61130 · GHSA-6vm2-wvf9-24gh

Improper access control in Oracle Commerce Platform

Priority MEDIUM 46

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00494 Published 2026-07-21 No fix listed CWE-284
TI-2026-43773 CVE-2026-61129 · GHSA-c35r-wmmq-534h

Improper authentication in Oracle Commerce Platform

Priority MEDIUM 49

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00508 Published 2026-07-21 No fix listed CWE-287
TI-2025-15536 CVE-2025-21576 · GHSA-hp7g-8x4v-4c78

Cross-site request forgery in Oracle Commerce Platform

Priority LOW 24

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0019 Published 2025-04-15 No fix listed CWE-352
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
Load more