# Oracle Commerce Guided Search


- [CVE-2022-22947](https://insights.sbomify.com/CVE-2022-22947/): VMware Spring Cloud Gateway Code Injection (critical 10.0, exploited in the wild)
- [CVE-2021-39144](https://insights.sbomify.com/CVE-2021-39144/): XStream Remote Code Execution (high 8.5, exploited in the wild)
- [CVE-2026-61146](https://insights.sbomify.com/CVE-2026-61146/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.9)
- [CVE-2026-70995](https://insights.sbomify.com/CVE-2026-70995/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.8)
- [CVE-2026-61145](https://insights.sbomify.com/CVE-2026-61145/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.8)
- [CVE-2026-61161](https://insights.sbomify.com/CVE-2026-61161/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.8)
- [CVE-2019-12419](https://insights.sbomify.com/CVE-2019-12419/): Potential session hijack in Apache CXF (critical 9.8)
- [CVE-2026-70998](https://insights.sbomify.com/CVE-2026-70998/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.3)
- [CVE-2026-71037](https://insights.sbomify.com/CVE-2026-71037/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.3)
- [CVE-2026-70976](https://insights.sbomify.com/CVE-2026-70976/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.1)
- [CVE-2026-70977](https://insights.sbomify.com/CVE-2026-70977/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.1)
- [CVE-2026-70978](https://insights.sbomify.com/CVE-2026-70978/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/commerce-guided-search/