First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-18318

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	i	7.6; 7.5; 7.4; 7.3

References

https://www.ibm.com/support/pages/node/7290096Patch, Vendor Advisory

Timeline

Published: Oct 13, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-18324.3The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a CVE-2026-183206.1Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attrib CVE-2026-183214.7Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd CVE-2026-183228.8The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This i CVE-2026-183237.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-183247.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-183257.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-183287.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site CVE-2026-183298.2Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request bo CVE-2026-18335.3The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.CVE-2026-183306.1A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within fir CVE-2026-183317.2The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cr

CVE-2026-18318: Medium severity, CVSS 5.3 | Vulnix