Skip to content
OpenAdvisories
Medium WID-SEC-2026-4092 3 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Oct 20, 2026 · Updated Oct 20, 2026 · de-DE

Vendor: Oracle Product: Commerce Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit und Integrität zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 3

  • High 7.1
    CVE-2026-101560

    Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server). The suppo…

    Oracle Oracle Commerce Platform
  • Medium 6.3
    CVE-2026-49844 Public exploit

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

    Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-54515 Public exploit

    jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References