First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-70466

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via specifically crafted requests.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 8.0.0, <= 8.0.2; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.13; >= 7.2.0, <= 7.2.13; >= 7.0.0, <= 7.0.12

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-157Vendor Advisory

Timeline

Published: Aug 12, 2026
Last modified: Nov 6, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-704673.8A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5 CVE-2026-704688.1A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, F CVE-2026-704697.5Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the stan CVE-2026-70474.3The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This i CVE-2026-704709.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFr CVE-2026-704716.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars in CVE-2026-704728.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-st CVE-2026-704738.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upse CVE-2026-704748.1Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 CVE-2026-704756.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endp CVE-2026-704768.2Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoi CVE-2026-704779.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatfl

CVE-2026-70466: Medium severity, CVSS 5.3 | Vulnix