Apache Software Foundation Apache OFBiz

• CVE-2026-50223 High 8.8 Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution 0.7%
• CVE-2026-46586 High 8.8 Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution 0.7%
• CVE-2026-45434 Critical 9.8 Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE 21.3%
• CVE-2026-45187 Medium 6.5 Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs 0.5%
• CVE-2026-41919 Critical 9.1 Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction 0.5%
• CVE-2026-35086 Medium 6.5 Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services 0.5%
• CVE-2026-31986 Critical 9.1 Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection 0.4%
• CVE-2026-31910 High 7.5 Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access 0.5%
• CVE-2026-31909 High 7.5 Apache OFBiz: Unauthenticated Shipment Label Image Disclosure 0.5%
• CVE-2026-31906 Medium 6.1 Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters 0.4%
• CVE-2026-31388 Medium 5.3 Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature 0.4%
• CVE-2026-31387 Medium 5.3 Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation 0.5%
• CVE-2026-31380 Medium 6.5 Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass 0.5%
• CVE-2026-31379 Medium 6.1 Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager 0.6%
• CVE-2026-31378 Medium 6.5 Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution 0.6%
• CVE-2026-29226 High 7.3 Apache OFBiz: Low-Privilege SSRF in Content Component 0.5%
• CVE-2026-29207 Medium 6.5 Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component 0.5%
• CVE-2026-29220 Medium 6.5 Apache OFBiz: Low-Privilege LFI in Content Component 0.7%
• CVE-2025-61623 Medium 6.5 Apache OFBiz: Reflected Cross-site Scripting 0.8%
• CVE-2025-59118 High 7.3 Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload 1.7%
• CVE-2025-54466 Medium 6.3 Apache OFBiz: RCE Vulnerability in scrum plugin 28.0%
• CVE-2025-30676 Medium 6.1 Apache OFBiz: Stored XSS Vulnerability 67.6%
• CVE-2025-26865 Low 3.5 Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE 0.7%
• CVE-2024-47208 Critical 9.8 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE 1.6%
• CVE-2024-48962 High 8.9 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) 0.6%
• CVE-2024-45507 High 8.8 Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE 96.4%
• CVE-2024-36104 Critical 9.1 Apache OFBiz: Path traversal leading to a RCE 87.9%
• CVE-2024-23946 Medium 5.3 Apache OFBiz: Path traversal or file inclusion 3.1%
• CVE-2024-25065 Critical 9.1 Apache OFBiz: Path traversal allowing authentication bypass. 47.7%
• CVE-2023-51467 Unrated Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability 96.0%
• CVE-2023-50968 Unrated Apache OFBiz: Arbitrary file properties reading and SSRF attack 63.4%
• CVE-2023-49070 Unrated Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present 95.4%
• CVE-2023-46819 Medium 5.3 Apache OFBiz: Execution of Solr plugin queries without authentication 1.8%
• CVE-2022-47501 High 7.5 Apache OFBiz: Arbitrary file reading vulnerability 10.2%
• CVE-2022-29158 Unrated Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz 2.2%
• CVE-2022-29063 Unrated Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz 5.1%
• CVE-2022-25813 Unrated Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz 67.3%
• CVE-2022-25371 Unrated Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz 5.4%
• CVE-2022-25370 Unrated Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz 2.8%
• CVE-2021-37608 Unrated Arbitrary file upload vulnerability in OFBiz 6.0%
• CVE-2021-30128 Unrated Unsafe deserialization in Apache OFBiz 81.2%
• CVE-2021-29200 Unrated RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI 55.4%
• CVE-2021-26295 Unrated RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI 97.8%