First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-14774

HighCVSS 7.4/10Last modified Jul 22, 2026

Description

Incorrect Authorization vulnerability in ABB T-MAC Plus.

This issue affects T-MAC Plus: 4.0-24.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
ABB	T-MAC Plus	4.0-24

References

https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A7840&LanguageCode=en&DocumentPartId=&Action=LaunchMitigation, Vendor Advisory

Timeline

Published: Jun 3, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-147776.0A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource man CVE-2025-147785.4A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection A CVE-2025-147793.8The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, whe CVE-2025-14787.5An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-147806.3A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the fi CVE-2025-147825.3The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all ve CVE-2025-147834.3The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is d CVE-2025-147856.4The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable CVE-2025-14795.3An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to ex CVE-2025-147906.5IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently pr CVE-2025-147924.4The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in a CVE-2025-147935.0The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

CVE-2025-14774: High severity, CVSS 7.4 | Vulnix