First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-103442

HighCVSS 7.2/10Last modified Nov 9, 2026

Description

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.

This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Metrics

CVSS 4.0 7.2/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
The Wikimedia Foundation	MediaWiki CentralAuth extension	1.46; 1.45; 1.43

References

Timeline

Published: Sep 30, 2026
Last modified: Nov 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1034431.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection CVE-2026-1034441.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum CVE-2026-1034451.2Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms CVE-2026-1034467.4Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authenticat CVE-2026-1034709.3In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate CVE-2026-1034717.5restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exha CVE-2026-1034727.5restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in CVE-2026-1034738.1Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escap CVE-2026-1034748.8yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload CVE-2026-1034759.1yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default devel CVE-2026-1034765.3yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated at CVE-2026-1034786.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[bi

CVE-2026-103442: High severity, CVSS 7.2 | Vulnix