First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-18260

MediumCVSS 5.7/10Last modified Sep 2, 2026

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Drupal	Disable Login Page	>= 0.0.0, < 1.1.4

References

Timeline

Published: Aug 25, 2026
Last modified: Sep 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-182615.7Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.CVE-2026-182627.8Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows loca CVE-2026-182637.8Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows loca CVE-2026-182648.8NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod CVE-2026-182659.8OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra CVE-2026-182665.4Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive informatio CVE-2026-182676.8Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to exe CVE-2026-182687.0Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca CVE-2026-182696.8Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attac CVE-2026-18276.4The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all ve CVE-2026-182707.8Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers CVE-2026-182716.8Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attacker

CVE-2026-18260: Medium severity, CVSS 5.7 | Vulnix