GCVE-110-NCSC-2026-28

Advisory PublishedCVSS 9.1/10

Vulnetix · Advisory published January 21, 2026

Multiple vulnerabilities across Oracle products, including Middleware, Business Intelligence, and SOA Suite, as well as XMLBeans, expose systems to unauthorized access and denial of service, with CVSS scores ranging from 7.3 to 9.1.

Download JSON Open in Console

Weaknesses (CWE)

CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')CWE-502Deserialization of Untrusted DataCWE-674Uncontrolled RecursionCWE-125Out-of-bounds ReadCWE-20Improper Input ValidationCWE-121Stack-based Buffer Overflow

Risk Scores

CVSS 3.1

9.1/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

Aliases

CVE-2021-23926 CVE-2022-45047 CVE-2024-57699 CVE-2025-31672 CVE-2025-48924 CVE-2025-52999 CVE-2025-9230 CVE-2026-21976

References

advisory

Browse GCVE Records

72,148 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON