First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-2414

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
HYPR	Server	>= 9.5.2, < 10.7.2

References

https://www.hypr.com/trust-center/security-advisoriesVendor Advisory

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-241405.3MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in CVE-2026-241417.8NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe dese CVE-2026-241429.8NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulner CVE-2026-241467.5NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a serv CVE-2026-241474.8NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading CVE-2026-241489.4NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initia CVE-2026-241497.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code inje CVE-2026-24155.9Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templat CVE-2026-241507.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciou CVE-2026-241517.8NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously cra CVE-2026-241527.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciou CVE-2026-241535.5NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulner

CVE-2026-2414: Critical severity, CVSS 9.8 | Vulnix