First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-107250

MediumCVSS 5.9/10Last modified Oct 30, 2026

Description

Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Drupal	ECA Helper	.

References

https://www.drupal.org/sa-contrib-2026-193

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1072516.5Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entit CVE-2026-1072525.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allow CVE-2026-1072535.9Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.CVE-2026-1072544.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass CVE-2026-1072557.3Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versi CVE-2026-1072565.3Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versi CVE-2026-1072576.5Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0 CVE-2026-1072585.4Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Di CVE-2026-1072595.4Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue CVE-2026-107266.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the CVE-2026-1072606.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stor CVE-2026-1072614.2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass

CVE-2026-107250: Medium severity, CVSS 5.9 | Vulnix