Oracle Commerce: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 39

• Critical 9.9
  CVE-2026-61146

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• Critical 9.8
  CVE-2026-4176

  Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

  Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-…

  SHAY perl perl openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 29, 2026
• Critical 9.8
  CVE-2026-61129

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported versio…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• Critical 9.8
  CVE-2026-61131

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• Critical 9.8
  CVE-2026-61145

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• Critical 9.8
  CVE-2026-61154

  Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…

  Oracle Oracle Commerce Guided Search Platform Services
  Jul 21, 2026
• Critical 9.8
  CVE-2026-61161

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• Critical 9.1
  CVE-2026-61130

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• Critical 9.1
  CVE-2026-61153

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• Critical 9.1
  CVE-2026-61155

  Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…

  Oracle Oracle Commerce Guided Search Platform Services
  Jul 21, 2026
• Critical 9.1
  CVE-2026-61156

  Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…

  Oracle Oracle Commerce Guided Search Platform Services
  Jul 21, 2026
• High 8.8
  CVE-2026-61148

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 8.8
  CVE-2026-61149

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 8.2
  CVE-2026-27601

  Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

  Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) att…

  jashkenas underscore katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  Mar 3, 2026
• High 8.1
  CVE-2026-61137

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• High 8.1
  CVE-2026-61150

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 8.1
  CVE-2026-61160

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 8.1
  CVE-2026-61163

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.6
  CVE-2026-61132

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• High 7.5
  CVE-2025-48976 Public exploit EPSS 34%

  Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

  Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2026-34487

  Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-42403

  Apache Neethi: Circular Policy Reference Infinite Loop

  Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infin…

  Apache Software Foundation Apache Neethi wildfly-openjdk-17 wildfly-openjdk-21 Wolfi Maven
  May 1, 2026
• High 7.5
  CVE-2026-42587

  Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

  netty io.netty netty netty-codec-http Debian Wolfi Maven
  May 13, 2026
• High 7.5
  CVE-2026-61133

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• High 7.5
  CVE-2026-61157

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.5
  CVE-2026-61158

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.5
  CVE-2026-61159

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.4
  CVE-2026-61135

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• High 7.4
  CVE-2026-61164

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.3
  CVE-2026-61136

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• High 7.1
  CVE-2026-61151

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.1
  CVE-2026-61162

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• High 7.1
  CVE-2026-61165

  Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…

  Oracle Oracle Commerce Guided Search Platform Services
  Jul 21, 2026
• Medium 6.8
  CVE-2026-61134

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…

  Oracle Oracle Commerce Platform
  Jul 21, 2026
• Medium 6.3
  CVE-2025-14017

  broken TLS options for threaded LDAPS

  When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine
  Jan 8, 2026
• Medium 6.3
  CVE-2025-68161

  Apache Log4j Core: Missing TLS hostname verification in Socket appender

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

  Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  Dec 18, 2025
• Medium 6.2
  CVE-2026-61147

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026
• Medium 6.1
  CVE-2026-34316

  Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). Th…

  Oracle Oracle Commerce Service Center
  Jul 21, 2026
• Medium 5.4
  CVE-2026-61152

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…

  Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager
  Jul 21, 2026

Revision history

1. 2026-07-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2026 - Appendix Oracle Commerce vom 2026-07-21
  https://www.oracle.com/security-alerts/cpujul2026.html#AppendixOCOM