First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-27880

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787 CWE-125 CWE-770

Affected software

Vendor	Product	Versions
Grafana	Grafana	>= v12.1.0, < v12.1.10; >= v12.2.0, < v12.2.8; >= v12.3.0, < v12.3.6; >= v12.4.0, < v12.4.2
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Mar 27, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-278815.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/de CVE-2026-278824.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webh CVE-2026-278835.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v CVE-2026-278845.3NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when CVE-2026-278857.2Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piw CVE-2026-278867.5Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sani CVE-2026-278876.9Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to al CVE-2026-278887.5pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads CVE-2026-278897.5NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versi CVE-2026-27899.8Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thun CVE-2026-278908.2Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specifi CVE-2026-278917.2FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins:

CVE-2026-27880: High severity, CVSS 7.5 | Vulnix