Advisories · Technology

Apache Software Foundation Apache OFBiz.

Every CVE that names Apache Software Foundation Apache OFBiz among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-66903 CVE record

CVSS 6.5 Medium

Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 5 Nov 2026
CVE-2026-71901 CVE record

CVSS 8.1 High

Apache OFBiz: Dispatch arbitrary internal services on SFA component
- Apache Software Foundation Apache OFBiz
- CWE-99
Not analysed yet 5 Nov 2026
CVE-2026-68524 CVE record

Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-73577 CVE record

Apache OFBiz: Unauthenticated path-suffix view authorization bypass
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 5 Nov 2026
CVE-2026-73578 CVE record

Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 5 Nov 2026
CVE-2026-73580 CVE record

Apache OFBiz: Unauthenticated HR organization and employee disclosure
- Apache Software Foundation Apache OFBiz
- Information disclosure
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-74841 CVE record

Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
- Apache Software Foundation Apache OFBiz
- Denial of service
Not analysed yet 5 Nov 2026
CVE-2026-76150 CVE record

Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-81734 CVE record

Apache OFBiz: Missing authorization - catalog quick-admin product writes
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-76152 CVE record

Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-81744 CVE record

Apache OFBiz: Authorization bypass - self-grant content OWNER
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-81808 CVE record

Apache OFBiz: Missing authorization - search-result bulk catalog mutation
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-81815 CVE record

Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
- Apache Software Foundation Apache OFBiz
- SQL injection
Not analysed yet 5 Nov 2026
CVE-2026-81816 CVE record

Apache OFBiz: XML external entity injection (XXE)
- Apache Software Foundation Apache OFBiz
- XML external entities (XXE)
Not analysed yet 5 Nov 2026
CVE-2026-81828 CVE record

Apache OFBiz: Server-side request forgery in SurveyWrapper
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
Not analysed yet 5 Nov 2026
CVE-2026-82894 CVE record

Apache OFBiz: Content renderer runs a service name stored on the row
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-82902 CVE record

CVSS 4.3 Medium

Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
- Apache Software Foundation Apache OFBiz
- Broken access control
- Server-side request forgery (SSRF)
Not analysed yet 5 Nov 2026
CVE-2026-82904 CVE record

CVSS 7.5 High

Apache OFBiz: Unbounded multi-form row count from a parameter name
- Apache Software Foundation Apache OFBiz
- Denial of service
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-82907 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 5 Nov 2026
CVE-2026-82910 CVE record

CVSS 8.8 High

Apache OFBiz: renderLink compiles link parameters as FreeMarker source
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-82912 CVE record

CVSS 8.8 High

Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-82916 CVE record

CVSS 7.1 High

Apache OFBiz: webtools xmldsdump exports any entity to any path
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-82960 CVE record

CVSS 8.8 High

Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-83538 CVE record

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
- Apache Software Foundation Apache OFBiz
- Information disclosure
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-83542 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache OFBiz: Unauthenticated RCE via login-page widget injection
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-84183 CVE record

CVSS 8.8 High

Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-84728 CVE record

CVSS 5.4 Medium

Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-85627 CVE record

Apache OFBiz: Authenticated Code Execution Vulnerability
- Apache Software Foundation Apache OFBiz
- Broken access control
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-92887 CVE record

Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
- Apache Software Foundation Apache OFBiz
- Authentication bypass
- CWE-1188
Not analysed yet 5 Nov 2026
CVE-2026-97355 CVE record

Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
- Apache Software Foundation Apache OFBiz
- Hard-coded credentials
Not analysed yet 5 Nov 2026
CVE-2026-97356 CVE record

Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 5 Nov 2026
CVE-2026-100168 CVE record

Apache OFBiz: Missing Authorization vulnerability
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-100228 CVE record

Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
- Apache Software Foundation Apache OFBiz
- CWE-20
Not analysed yet 5 Nov 2026
CVE-2026-105325 CVE record

Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-105330 CVE record

Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
- Apache Software Foundation Apache OFBiz
- Hard-coded credentials
Not analysed yet 5 Nov 2026
CVE-2026-105461 CVE record

Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-109129 CVE record

Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-109837 CVE record

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-109856 CVE record

Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-109928 CVE record

Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 5 Nov 2026
CVE-2026-114229 CVE record

Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2026
CVE-2026-114233 CVE record

Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
- Apache Software Foundation Apache OFBiz
- Privilege escalation
Not analysed yet 5 Nov 2026
CVE-2026-114235 CVE record

Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-114271 CVE record

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-114272 CVE record

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-114277 CVE record

Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
- Apache Software Foundation Apache OFBiz
- CWE-302
Not analysed yet 5 Nov 2026
CVE-2026-47342 CVE record

CVSS 8.8 High

Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 10 Jun 2026
CVE-2026-50223 CVE record

CVSS 8.8 High

Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 10 Jun 2026
CVE-2026-46586 CVE record

CVSS 8.8 High

Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 19 May 2026
CVE-2026-45434 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-45187 CVE record

CVSS 6.5 Medium

Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 19 May 2026
CVE-2026-41919 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction
- Apache Software Foundation Apache OFBiz
- Other injection
Not analysed yet 19 May 2026
CVE-2026-35086 CVE record

CVSS 6.5 Medium

Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 19 May 2026
CVE-2026-31986 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection
- Apache Software Foundation Apache OFBiz
- Hard-coded credentials
Not analysed yet 19 May 2026
CVE-2026-31910 CVE record

CVSS 7.5 High

Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
Not analysed yet 19 May 2026
CVE-2026-31909 CVE record

CVSS 7.5 High

Apache OFBiz: Unauthenticated Shipment Label Image Disclosure
- Apache Software Foundation Apache OFBiz
- Information disclosure
Not analysed yet 19 May 2026
CVE-2026-31906 CVE record

CVSS 6.1 Medium

Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
Not analysed yet 19 May 2026
CVE-2026-31388 CVE record

CVSS 5.3 Medium

Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 19 May 2026
CVE-2026-31387 CVE record

CVSS 5.3 Medium

Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-31380 CVE record

CVSS 6.5 Medium

Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 19 May 2026