First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-12702

MediumCVSS 4.9/10Last modified Oct 24, 2026

Description

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Octopus Deploy	Octopus Server	>= 2023.0.0, < 2026.1.11587; >= 2026.1.0, < 2026.1.11587; >= 2026.2.0, < 2026.2.13190

References

https://advisories.octopus.com/post/2026/sa2026-06Vendor Advisory

Timeline

Published: Jul 24, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1270297.5A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling au CVE-2026-127038.0TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to by CVE-2026-1270307.5A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session tic CVE-2026-1270368.6Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 thro CVE-2026-127046.8When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML resp CVE-2026-1270469.2The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externa CVE-2026-127056.4Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update To CVE-2026-1270506.4Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker t CVE-2026-1270567.5PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause de CVE-2026-1270584.9WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated att CVE-2026-127066.5A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decomp CVE-2026-127077.5Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client

CVE-2026-12702: Medium severity, CVSS 4.9 | Vulnix