First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-92120

CriticalCVSS 9.1/10Last modified Oct 16, 2026

Description

OAuth1 Request Replay Attack vulnerability in Apache Allura.

This issue affects Apache Allura: through 1.21.0.

Users are recommended to upgrade to version 1.22.0 which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Allura	<= 1.21.0

References

Timeline

Published: Oct 12, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-921217.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" fla CVE-2026-921228.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed CVE-2026-921238.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, p CVE-2026-921248.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a CVE-2026-921258.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing atta CVE-2026-921268.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an CVE-2026-921278.0Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when CVE-2026-921287.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the CVE-2026-921297.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to CVE-2026-92138.1A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the ro CVE-2026-921303.1Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol CVE-2026-921314.2Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline

CVE-2026-92120: Critical severity, CVSS 9.1 | Vulnix