Odoo Odoo Community

Name: Odoo Odoo Community
Brand: Odoo

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical9high21medium0low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-29396US	high8.8	3.13% (88th)	—	unspecified	2020-12-22	2 versions
CVE-2019-11781US	high8.8	2.08% (81st)	—	no fix	2020-12-22	≤ unspecified ≤12.0
CVE-2019-11780US	high8.1	2.06% (81st)	—	no fix	2019-12-19	≤ 13.0
CVE-2019-11785US	medium4.3OT elevated	1.49% (74th)	—	no fix	2020-12-22	≤ unspecified ≤13.0
CVE-2019-11782US	medium6.5	1.46% (74th)	—	no fix	2020-12-22	≤ unspecified ≤14.0
CVE-2021-26947US	medium6.1	1.40% (72nd)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2018-15631US	medium6.5	1.37% (72nd)	—	no fix	2019-04-09	≤ unspecified ≤12.0
CVE-2018-15632US	critical9.1	1.18% (68th)	—	no fix	2020-12-22	≤ unspecified ≤11.0
CVE-2018-15635US	medium6.1	1.00% (63rd)	—	no fix	2019-04-09	≤ unspecified ≤12.0
CVE-2019-11784US	medium6.5OT elevated	0.99% (62nd)	—	no fix	2020-12-22	≤ unspecified ≤14.0
CVE-2019-11783US	medium6.5OT elevated	0.99% (62nd)	—	no fix	2020-12-22	≤ unspecified ≤14.0
CVE-2018-15634US	medium6.1	0.91% (60th)	—	no fix	2020-12-22	≤ unspecified ≤14.0
CVE-2018-15633US	medium6.1	0.89% (59th)	—	no fix	2020-12-22	≤ unspecified ≤11.0
CVE-2018-15645US	medium6.5	0.88% (59th)	—	no fix	2020-12-22	≤ unspecified ≤12.0
CVE-2021-23203US	high7.5OT elevated	0.88% (59th)	—	no fix	2023-04-25	≤ 14.0 ≤15.0
CVE-2021-45111US	high8.1	0.84% (58th)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-23176US	medium6.5	0.78% (56th)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2018-15641US	medium5.4	0.71% (53rd)	—	unspecified	2020-12-22	2 versions
CVE-2019-11786US	medium4.3	0.70% (53rd)	—	no fix	2020-12-22	≤ unspecified ≤13.0
CVE-2018-15638US	medium5.4	0.70% (53rd)	—	no fix	2020-12-22	≤ unspecified ≤13.0
CVE-2021-44547US	critical9.1	0.69% (53rd)	—	no fix	2023-04-25	≤ 15.0
CVE-2024-12368US	high8.8	0.69% (53rd)	—	no fix	2025-02-25	≤ 15.0
CVE-2024-36259US	medium6.5	0.69% (53rd)	—	no fix	2025-02-25	≤ master ≤17.0
CVE-2021-44460US	medium6.5	0.69% (53rd)	—	no fix	2023-04-25	≤ 0 ≤13.0
CVE-2021-45071US	medium6.1	0.65% (51st)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-23186US	high8.7	0.64% (51st)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-23166US	high8.7OT elevated	0.64% (51st)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-23178US	high7.5	0.56% (47th)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-26263US	medium6.1	0.56% (46th)	—	no fix	2023-04-25	≤ 14.0 ≤15.0
CVE-2021-44775US	medium6.1	0.55% (46th)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-44476US	medium6.8	0.48% (41st)	—	no fix	2023-04-25	≤ 0 ≤15.0
CVE-2021-44465US	medium4.3OT elevated	0.46% (40th)	—	no fix	2023-04-25	≤ 0 ≤13.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-284Improper Access Control16 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')9 CVEs
CWE-267Privilege Defined With Unsafe Actions5 CVEs
CWE-862Missing Authorization3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-269Improper Privilege Management1 CVEs
CWE-276Incorrect Default Permissions1 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan