PULSE
EN
FEED
ransomwhitearmor reclama a Verification · Technologyransomulose reclama a zzq-testransomulose reclama a probe-011637cabbf94076-ransomdragonforce reclama a Zhito Technology · UA · Technologyransomsilentransomgroup reclama a Morrison Cohen · US · Professional Servicesransomemperador reclama a Afflelou · FR · Retail & E-Commerceransombyod reclama a University of New Mexico · US · Educationransomrhysida reclama a MISC Group · MY · Energy & Utilitiesransomn0n reclama a Ingelectus Innovative Electrical Solutions S.L. · ES · Energy & Utilitiesransomwhitearmor reclama a Gamdom · Otherransomfalcon reclama a Beasley Allen Law Firm · US · Professional Servicesransomqilin reclama a RaceTrakka · AU · Retail & E-Commerceransomqilin reclama a Smith Feddeler & Smith · US · Professional Servicesransomqilin reclama a Delta Electric Power Association · US · Energy & Utilitiesransomwhitearmor reclama a Verification · Technologyransomulose reclama a zzq-testransomulose reclama a probe-011637cabbf94076-ransomdragonforce reclama a Zhito Technology · UA · Technologyransomsilentransomgroup reclama a Morrison Cohen · US · Professional Servicesransomemperador reclama a Afflelou · FR · Retail & E-Commerceransombyod reclama a University of New Mexico · US · Educationransomrhysida reclama a MISC Group · MY · Energy & Utilitiesransomn0n reclama a Ingelectus Innovative Electrical Solutions S.L. · ES · Energy & Utilitiesransomwhitearmor reclama a Gamdom · Otherransomfalcon reclama a Beasley Allen Law Firm · US · Professional Servicesransomqilin reclama a RaceTrakka · AU · Retail & E-Commerceransomqilin reclama a Smith Feddeler & Smith · US · Professional Servicesransomqilin reclama a Delta Electric Power Association · US · Energy & Utilities
← Todos los CVEs
CVE Watch21 sept 2026

CVE-2026-83240

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The

CVSS

7.1

Alto

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Publicado: 15 sept 2026 · Última mod.: 21 sept 2026 · CWE-284

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-09-282026-10-25
Descripción técnica

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1168095.3 MED
—
———OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.9hCVE-2026-1166034.7 MED
—
———A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.9hCVE-2026-1165075.3 MED
—
———A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.11hCVE-2013-100775.3 MED
—
———A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.16hCVE-2026-1162844.3 MED
—
———A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.14hCVE-2026-1162834.3 MED
—
———A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.14h