# Apache Software Foundation Apache OFBiz. Every CVE that names Apache Software Foundation Apache OFBiz among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Apache OFBiz: Authenticated Path Traversal in Catalog Image Management](https://agentprime.io/advisories/CVE-2026-66903.md) `CVE-2026-66903` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Apache OFBiz: Dispatch arbitrary internal services on SFA component](https://agentprime.io/advisories/CVE-2026-71901.md) `CVE-2026-71901` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-99 - [Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading](https://agentprime.io/advisories/CVE-2026-68524.md) `CVE-2026-68524` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: Unauthenticated path-suffix view authorization bypass](https://agentprime.io/advisories/CVE-2026-73577.md) `CVE-2026-73577` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact](https://agentprime.io/advisories/CVE-2026-73578.md) `CVE-2026-73578` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Apache OFBiz: Unauthenticated HR organization and employee disclosure](https://agentprime.io/advisories/CVE-2026-73580.md) `CVE-2026-73580` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode](https://agentprime.io/advisories/CVE-2026-74841.md) `CVE-2026-74841` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service - [Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage](https://agentprime.io/advisories/CVE-2026-76150.md) `CVE-2026-76150` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Missing authorization - catalog quick-admin product writes](https://agentprime.io/advisories/CVE-2026-81734.md) `CVE-2026-81734` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services](https://agentprime.io/advisories/CVE-2026-76152.md) `CVE-2026-76152` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Authorization bypass - self-grant content OWNER](https://agentprime.io/advisories/CVE-2026-81744.md) `CVE-2026-81744` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Missing authorization - search-result bulk catalog mutation](https://agentprime.io/advisories/CVE-2026-81808.md) `CVE-2026-81808` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB](https://agentprime.io/advisories/CVE-2026-81815.md) `CVE-2026-81815` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection - [Apache OFBiz: XML external entity injection (XXE)](https://agentprime.io/advisories/CVE-2026-81816.md) `CVE-2026-81816` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: XML external entities (XXE) - [Apache OFBiz: Server-side request forgery in SurveyWrapper](https://agentprime.io/advisories/CVE-2026-81828.md) `CVE-2026-81828` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Server-side request forgery (SSRF) - [Apache OFBiz: Content renderer runs a service name stored on the row](https://agentprime.io/advisories/CVE-2026-82894.md) `CVE-2026-82894` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile](https://agentprime.io/advisories/CVE-2026-82902.md) `CVE-2026-82902` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Apache OFBiz: Unbounded multi-form row count from a parameter name](https://agentprime.io/advisories/CVE-2026-82904.md) `CVE-2026-82904` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service, Broken access control - [Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound](https://agentprime.io/advisories/CVE-2026-82907.md) `CVE-2026-82907` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Apache OFBiz: renderLink compiles link parameters as FreeMarker source](https://agentprime.io/advisories/CVE-2026-82910.md) `CVE-2026-82910` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: Unsandboxed Groovy compiled from a service parameter](https://agentprime.io/advisories/CVE-2026-82912.md) `CVE-2026-82912` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: webtools xmldsdump exports any entity to any path](https://agentprime.io/advisories/CVE-2026-82916.md) `CVE-2026-82916` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE](https://agentprime.io/advisories/CVE-2026-82960.md) `CVE-2026-82960` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers](https://agentprime.io/advisories/CVE-2026-83538.md) `CVE-2026-83538` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache OFBiz: Unauthenticated RCE via login-page widget injection](https://agentprime.io/advisories/CVE-2026-83542.md) `CVE-2026-83542` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection - [Apache OFBiz: Content Manager VIEW-only RCE in updateLayout](https://agentprime.io/advisories/CVE-2026-84183.md) `CVE-2026-84183` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login](https://agentprime.io/advisories/CVE-2026-84728.md) `CVE-2026-84728` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authenticated Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-85627.md) `CVE-2026-85627` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Code injection - [Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation](https://agentprime.io/advisories/CVE-2026-92887.md) `CVE-2026-92887` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, CWE-1188 - [Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-97355.md) `CVE-2026-97355` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials - [Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass](https://agentprime.io/advisories/CVE-2026-97356.md) `CVE-2026-97356` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Apache OFBiz: Missing Authorization vulnerability](https://agentprime.io/advisories/CVE-2026-100168.md) `CVE-2026-100168` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation](https://agentprime.io/advisories/CVE-2026-100228.md) `CVE-2026-100228` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20 - [Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations](https://agentprime.io/advisories/CVE-2026-105325.md) `CVE-2026-105325` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access](https://agentprime.io/advisories/CVE-2026-105330.md) `CVE-2026-105330` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials - [Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities](https://agentprime.io/advisories/CVE-2026-105461.md) `CVE-2026-105461` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification](https://agentprime.io/advisories/CVE-2026-109129.md) `CVE-2026-109129` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association](https://agentprime.io/advisories/CVE-2026-109837.md) `CVE-2026-109837` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation](https://agentprime.io/advisories/CVE-2026-109856.md) `CVE-2026-109856` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover](https://agentprime.io/advisories/CVE-2026-109928.md) `CVE-2026-109928` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass - [Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session](https://agentprime.io/advisories/CVE-2026-114229.md) `CVE-2026-114229` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders](https://agentprime.io/advisories/CVE-2026-114233.md) `CVE-2026-114233` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation - [Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification](https://agentprime.io/advisories/CVE-2026-114235.md) `CVE-2026-114235` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification](https://agentprime.io/advisories/CVE-2026-114271.md) `CVE-2026-114271` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure](https://agentprime.io/advisories/CVE-2026-114272.md) `CVE-2026-114272` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts](https://agentprime.io/advisories/CVE-2026-114277.md) `CVE-2026-114277` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-302 - [Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass](https://agentprime.io/advisories/CVE-2026-47342.md) `CVE-2026-47342` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control - [Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-50223.md) `CVE-2026-50223` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2026 · Tags: Code injection - [Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution](https://agentprime.io/advisories/CVE-2026-46586.md) `CVE-2026-46586` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Code injection - [Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE](https://agentprime.io/advisories/CVE-2026-45434.md) `CVE-2026-45434` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass - [Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs](https://agentprime.io/advisories/CVE-2026-45187.md) `CVE-2026-45187` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control - [Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction](https://agentprime.io/advisories/CVE-2026-41919.md) `CVE-2026-41919` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Other injection - [Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services](https://agentprime.io/advisories/CVE-2026-35086.md) `CVE-2026-35086` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Code injection - [Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection](https://agentprime.io/advisories/CVE-2026-31986.md) `CVE-2026-31986` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Hard-coded credentials - [Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access](https://agentprime.io/advisories/CVE-2026-31910.md) `CVE-2026-31910` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF) - [Apache OFBiz: Unauthenticated Shipment Label Image Disclosure](https://agentprime.io/advisories/CVE-2026-31909.md) `CVE-2026-31909` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure - [Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters](https://agentprime.io/advisories/CVE-2026-31906.md) `CVE-2026-31906` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.1 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS) - [Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature](https://agentprime.io/advisories/CVE-2026-31388.md) `CVE-2026-31388` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control - [Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation](https://agentprime.io/advisories/CVE-2026-31387.md) `CVE-2026-31387` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass - [Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass](https://agentprime.io/advisories/CVE-2026-31380.md) `CVE-2026-31380` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Code injection Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .