First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-13367

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	Informix Dynamic Server	14.10; 15.0

References

https://www.ibm.com/support/pages/node/7282829Vendor Advisory

Timeline

Published: Aug 12, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-133688.1WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN wi CVE-2026-133697.5The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, CVE-2026-13375.4Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the CVE-2026-133714.9An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted d CVE-2026-133727.2Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.CVE-2026-133734.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpa CVE-2026-133744.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Connect CVE-2026-133754.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotas CVE-2026-133764.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBloc CVE-2026-133774.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Prox CVE-2026-133787.2The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field CVE-2026-133799.1The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a ser