First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-33565

LowCVSS 3.3/10Last modified Jul 24, 2026

Description

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
OpenHarmony	OpenHarmony	>= v5.0.3, <= v6.0

References

https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md

Timeline

Published: May 19, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-335665.1There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the CVE-2026-335675.4Improper input validation for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privilege CVE-2026-335689.1A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.CVE-2026-335696.5Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can CVE-2026-33578.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an in CVE-2026-335705.7PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operati CVE-2026-335716.9Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of CVE-2026-335725.5OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcr CVE-2026-335738.8OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with o CVE-2026-335744.7OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically bu CVE-2026-335757.5OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenC CVE-2026-335766.5OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders

CVE-2026-33565: Low severity, CVSS 3.3 | Vulnix