VDB
GCVE-110-NCSC-2026-256
GCVE-110-NCSC-2026-256
Advisory PublishedCVSS 8.8/10
Multiple vulnerabilities including write-what-where and buffer overflow in Libtiff (up to 4.7.0) and network vulnerabilities in Oracle Communications Policy Management 15.0.0.0 and Oracle AutoVue 21.1.0 allow user-interaction-based exploitation potentially leading to code execution or system compromise.
Weaknesses (CWE)
CWE-123Write-what-where ConditionCWE-150Improper Neutralization of Escape, Meta, or Control SequencesCWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')CWE-1395Dependency on Vulnerable Third-Party ComponentCWE-94Improper Control of Generation of Code ('Code Injection')CWE-416Use After FreeCWE-1285Improper Validation of Specified Index, Position, or Offset in InputCWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')CWE-131Incorrect Calculation of Buffer SizeCWE-862Missing AuthorizationCWE-502Deserialization of Untrusted Data
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Oracle Corporation | vers:unknown/* | — | — |
| Oracle | vers:unknown/* | — | — |
Browse GCVE Records
417 records in the GCVE database · Updated August 26, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.