First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-35228

HighCVSS 8.7/10Last modified Oct 26, 2026

Description

Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). The supported versions that is affected is 1.0.1-1.0.156. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MCP Server Helper Tool. Successful attacks of this vulnerability can result in Oracle MCP Server Helper Tool executing malicious SQL.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Oracle Corporation	Oracle MCP Server Helper Tool product of Oracle Open Source Projects	1.0.1-1.0.156

References

https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html

Timeline

Published: May 5, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-352297.5Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easi CVE-2026-35234.9The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.CVE-2026-352307.5Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.CVE-2026-352317.5Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Inte CVE-2026-352325.4Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and CVE-2026-352334.4An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-leve CVE-2026-352344.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 9.0.0-9.CVE-2026-352354.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. E CVE-2026-352364.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0 CVE-2026-352374.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0 CVE-2026-352384.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0 CVE-2026-352394.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45,

CVE-2026-35228: High severity, CVSS 8.7 | Vulnix