Apache Software Foundation Apache OFBiz

• CVE-2024-45195 Critical 9.8 Exploited Apache OFBiz: Confused controller-view authorization logic (forced browsing) 100.0%
• CVE-2024-38856 High 8.1 Exploited Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code 99.4%
• CVE-2024-32113 Critical 9.1 Exploited Apache OFBiz: Path traversal leading to RCE 99.9%
• CVE-2026-66903 Medium 6.5 Apache OFBiz: Authenticated Path Traversal in Catalog Image Management 0.4%
• CVE-2026-71901 High 8.1 Apache OFBiz: Dispatch arbitrary internal services on SFA component 0.4%
• CVE-2026-68524 Unrated Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading 0.2%
• CVE-2026-73577 Unrated Apache OFBiz: Unauthenticated path-suffix view authorization bypass 0.3%
• CVE-2026-73578 Unrated Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact 0.3%
• CVE-2026-73580 Unrated Apache OFBiz: Unauthenticated HR organization and employee disclosure 0.2%
• CVE-2026-74841 Unrated Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode 0.2%
• CVE-2026-76150 Unrated Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage 0.2%
• CVE-2026-81734 Unrated Apache OFBiz: Missing authorization - catalog quick-admin product writes 0.2%
• CVE-2026-76152 Unrated Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services 0.2%
• CVE-2026-81744 Unrated Apache OFBiz: Authorization bypass - self-grant content OWNER 0.2%
• CVE-2026-81808 Unrated Apache OFBiz: Missing authorization - search-result bulk catalog mutation 0.2%
• CVE-2026-81815 Unrated Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB 0.3%
• CVE-2026-81816 Unrated Apache OFBiz: XML external entity injection (XXE) 0.3%
• CVE-2026-81828 Unrated Apache OFBiz: Server-side request forgery in SurveyWrapper 0.2%
• CVE-2026-82894 Unrated Apache OFBiz: Content renderer runs a service name stored on the row 0.5%
• CVE-2026-82902 Medium 4.3 Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile 0.4%
• CVE-2026-82904 High 7.5 Apache OFBiz: Unbounded multi-form row count from a parameter name 0.6%
• CVE-2026-82907 Critical 9.8 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound 0.8%
• CVE-2026-82910 High 8.8 Apache OFBiz: renderLink compiles link parameters as FreeMarker source 0.6%
• CVE-2026-82912 High 8.8 Apache OFBiz: Unsandboxed Groovy compiled from a service parameter 0.7%
• CVE-2026-82916 High 7.1 Apache OFBiz: webtools xmldsdump exports any entity to any path 0.4%
• CVE-2026-82960 High 8.8 Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE 0.6%
• CVE-2026-83538 Unrated Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers 0.3%
• CVE-2026-83542 Critical 9.8 Apache OFBiz: Unauthenticated RCE via login-page widget injection 1.1%
• CVE-2026-84183 High 8.8 Apache OFBiz: Content Manager VIEW-only RCE in updateLayout 1.0%
• CVE-2026-84728 Medium 5.4 Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login 0.3%
• CVE-2026-85627 Unrated Apache OFBiz: Authenticated Code Execution Vulnerability 0.3%
• CVE-2026-92887 Unrated Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation 0.2%
• CVE-2026-97355 Unrated Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service 0.2%
• CVE-2026-97356 Unrated Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass 0.2%
• CVE-2026-100168 Unrated Apache OFBiz: Missing Authorization vulnerability 0.2%
• CVE-2026-100228 Unrated Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation 0.2%
• CVE-2026-105325 Unrated Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations 0.1%
• CVE-2026-105330 Unrated Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access 0.2%
• CVE-2026-105461 Unrated Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities 0.1%
• CVE-2026-109129 Unrated Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification 0.2%
• CVE-2026-109837 Unrated Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association 0.2%
• CVE-2026-109856 Unrated Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation 0.2%
• CVE-2026-109928 Unrated Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover 0.2%
• CVE-2026-114229 Unrated Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session 0.2%
• CVE-2026-114233 Unrated Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders 0.2%
• CVE-2026-114235 Unrated Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification 0.2%
• CVE-2026-114271 Unrated Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification 0.2%
• CVE-2026-114272 Unrated Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure 0.2%
• CVE-2026-114277 Unrated Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts 0.2%
• CVE-2026-47342 High 8.8 Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass 0.4%