GCVE-110-NCSC-2026-444

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published October 21, 2026

Multiple vulnerabilities affect Apache Commons BeanUtils, allowing arbitrary code execution via the declaredClass property on Java enum objects, alongside several easily exploitable HTTP-based takeover vulnerabilities in various Oracle and HPE products.

Download JSON Open in Console

Weaknesses (CWE)

CWE-122Heap-based Buffer OverflowCWE-416Use After FreeCWE-295Improper Certificate ValidationCWE-173Improper Handling of Alternate EncodingCWE-190Integer Overflow or WraparoundCWE-346Origin Validation ErrorCWE-862Missing AuthorizationCWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')CWE-674Uncontrolled RecursionCWE-131Incorrect Calculation of Buffer SizeCWE-502Deserialization of Untrusted DataCWE-414Missing Lock CheckCWE-294Authentication Bypass by Capture-replayCWE-191Integer Underflow (Wrap or Wraparound)CWE-770Allocation of Resources Without Limits or ThrottlingCWE-121Stack-based Buffer OverflowCWE-617Reachable AssertionCWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')CWE-863Incorrect AuthorizationCWE-754Improper Check for Unusual or Exceptional ConditionsCWE-407Inefficient Algorithmic ComplexityCWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CWE-23Relative Path TraversalCWE-306Missing Authentication for Critical Function

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

References

advisory

Browse GCVE Records

854 records in the GCVE database · Updated October 30, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON