VDB
GCVE-110-NCSC-2026-257
GCVE-110-NCSC-2026-257
Advisory PublishedCVSS 8.1/10
Jersey's SAX parser contains an XML external entity (XXE) vulnerability due to not disabling parameter entities, enabling remote attackers to access sensitive information via crafted XML data.
Weaknesses (CWE)
CWE-611Improper Restriction of XML External Entity ReferenceCWE-502Deserialization of Untrusted DataCWE-770Allocation of Resources Without Limits or ThrottlingCWE-297Improper Validation of Certificate with Host Mismatch
Risk Scores
CVSS 3.1
8.1/10
High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Oracle | vers:unknown/* | — | — |
Aliases
CVE-2014-3643CVE-2020-9547CVE-2025-68161CVE-2025-8916CVE-2026-46984CVE-2026-46985CVE-2026-46986CVE-2026-46987CVE-2026-46988CVE-2026-46989CVE-2026-46990CVE-2026-46991CVE-2026-46992CVE-2026-46993CVE-2026-46994CVE-2026-46995CVE-2026-46996CVE-2026-46997CVE-2026-46998CVE-2026-46999CVE-2026-47000CVE-2026-47001CVE-2026-47002CVE-2026-47003CVE-2026-47004CVE-2026-47005CVE-2026-47006
Browse GCVE Records
75,823 records in the GCVE database · Updated August 3, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.