First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-10622

HighCVSS 8.2/10Last modified Jul 22, 2026

Description

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Collibra	Collibra Platform (on-prem)	>= 2026.03, < 2026.03.356
Collibra	Collibra Platform (on-prem)	>= 2025.10, < 2025.10.399
Collibra	Collibra Platform (SaaS)	>= 2026.04, < 2026.04.5
Collibra	Collibra Platform (SaaS)	>= 2026.03, < 2026.03.4
Collibra	Collibra Platform (SaaS)	>= 2026.02, < 2026.02.6
Collibra	Collibra Platform (SaaS)	>= 2025.11, < 2025.11.7
Collibra	Collibra Platform (SaaS)	>= 2025.10, < 2025.10.9

References

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1062208.8Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafte CVE-2026-1062218.3Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to CVE-2026-1062225.9Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafte CVE-2026-1062234.7Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the san CVE-2026-1062243.1Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proc CVE-2026-1062258.8Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain CVE-2026-1062264.2Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer CVE-2026-1062279.6Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a CVE-2026-1062288.3Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to CVE-2026-1062295.4UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass CVE-2026-106234.3The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Refe CVE-2026-1062305.3Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromise

CVE-2026-10622: High severity, CVSS 8.2 | Vulnix