CVE-2025-54988

On January 20, 2026, Oracle released its Critical Patch Update (CPU) for January 2026, addressing 337 security vulnerabilities across 122 products. This update includes fixes for 158 unique CVEs, with 27 patches classified as critical, impacting various Oracle product families such as databases and...

The Apache Foundation has issued a warning regarding a critical 10.0-rated vulnerability in its Tika toolkit, which is used for metadata extraction from over 1,000 file formats. This follows a previously reported 8.4-rated flaw (CVE-2025-54988) that allowed XML External Entity injection via crafted...