First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-117530

MediumCVSS 6.7/10Last modified Nov 4, 2026

Description

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	Junie CLI	< 26.8.17

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1175315.9@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the pl CVE-2026-1175329.8REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthentic CVE-2026-1175334.4REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files int CVE-2026-1175345.4REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete his CVE-2026-1175356.1REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link pa CVE-2026-1175368.8REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the C CVE-2026-1175374.1REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the t CVE-2026-1175384.1REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is co CVE-2026-1175393.5darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed exte CVE-2026-117545.3Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE:CVE-2026-1175407.5svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole CVE-2026-1175415.3svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting wel

CVE-2026-117530: Medium severity, CVSS 6.7 | Vulnix