First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-10458

HighCVSS 7.6/10Last modified Oct 13, 2026

Description

Parameters are not validated or sanitized, and are later used in various internal operations.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
zephyrproject-rtos	Zephyr	< 4.3.0

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vmww-237q-2fwpVendor Advisory

Timeline

Published: Sep 19, 2025
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-104599.8A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-CVE-2025-10467.8Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar CVE-2025-104609.4A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor CVE-2025-104615.3Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules)CVE-2025-104637.3Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. CVE-2025-104646.5Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retr CVE-2025-104658.8Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allow CVE-2025-104665.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access be CVE-2025-104678.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardwa CVE-2025-104687.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversa CVE-2025-10477.8Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attack CVE-2025-104708.6The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, lead

CVE-2025-10458: High severity, CVSS 7.6 | Vulnix