agentprime: apache-software-foundation-apache-ofbizEvery new CVE for apache-software-foundation-apache-ofbiz.https://agentprime.io/CVE-2026-66903: Apache OFBiz: Authenticated Path Traversal in Catalog Image Managementhttps://agentprime.io/advisories/CVE-2026-66903/https://agentprime.io/advisories/CVE-2026-66903/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:12:30 GMTCVECVE-2026-71901: Apache OFBiz: Dispatch arbitrary internal services on SFA componenthttps://agentprime.io/advisories/CVE-2026-71901/https://agentprime.io/advisories/CVE-2026-71901/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:12:01 GMTCVECVE-2026-68524: Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loadinghttps://agentprime.io/advisories/CVE-2026-68524/https://agentprime.io/advisories/CVE-2026-68524/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:11:35 GMTCVECVE-2026-73577: Apache OFBiz: Unauthenticated path-suffix view authorization bypasshttps://agentprime.io/advisories/CVE-2026-73577/https://agentprime.io/advisories/CVE-2026-73577/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:11:06 GMTCVECVE-2026-73578: Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impacthttps://agentprime.io/advisories/CVE-2026-73578/https://agentprime.io/advisories/CVE-2026-73578/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:10:39 GMTCVECVE-2026-73580: Apache OFBiz: Unauthenticated HR organization and employee disclosurehttps://agentprime.io/advisories/CVE-2026-73580/https://agentprime.io/advisories/CVE-2026-73580/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:10:09 GMTCVECVE-2026-74841: Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modehttps://agentprime.io/advisories/CVE-2026-74841/https://agentprime.io/advisories/CVE-2026-74841/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:09:41 GMTCVECVE-2026-76150: Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImagehttps://agentprime.io/advisories/CVE-2026-76150/https://agentprime.io/advisories/CVE-2026-76150/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:09:10 GMTCVECVE-2026-81734: Apache OFBiz: Missing authorization - catalog quick-admin product writeshttps://agentprime.io/advisories/CVE-2026-81734/https://agentprime.io/advisories/CVE-2026-81734/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:08:40 GMTCVECVE-2026-76152: Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate serviceshttps://agentprime.io/advisories/CVE-2026-76152/https://agentprime.io/advisories/CVE-2026-76152/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:08:12 GMTCVECVE-2026-81744: Apache OFBiz: Authorization bypass - self-grant content OWNERhttps://agentprime.io/advisories/CVE-2026-81744/https://agentprime.io/advisories/CVE-2026-81744/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:07:49 GMTCVECVE-2026-81808: Apache OFBiz: Missing authorization - search-result bulk catalog mutationhttps://agentprime.io/advisories/CVE-2026-81808/https://agentprime.io/advisories/CVE-2026-81808/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:07:19 GMTCVECVE-2026-81815: Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBhttps://agentprime.io/advisories/CVE-2026-81815/https://agentprime.io/advisories/CVE-2026-81815/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:06:58 GMTCVECVE-2026-81816: Apache OFBiz: XML external entity injection (XXE)https://agentprime.io/advisories/CVE-2026-81816/https://agentprime.io/advisories/CVE-2026-81816/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:06:35 GMTCVECVE-2026-81828: Apache OFBiz: Server-side request forgery in SurveyWrapperhttps://agentprime.io/advisories/CVE-2026-81828/https://agentprime.io/advisories/CVE-2026-81828/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:06:07 GMTCVECVE-2026-82894: Apache OFBiz: Content renderer runs a service name stored on the rowhttps://agentprime.io/advisories/CVE-2026-82894/https://agentprime.io/advisories/CVE-2026-82894/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:05:44 GMTCVECVE-2026-82902: Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafilehttps://agentprime.io/advisories/CVE-2026-82902/https://agentprime.io/advisories/CVE-2026-82902/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:05:23 GMTCVECVE-2026-82904: Apache OFBiz: Unbounded multi-form row count from a parameter namehttps://agentprime.io/advisories/CVE-2026-82904/https://agentprime.io/advisories/CVE-2026-82904/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:04:40 GMTCVECVE-2026-82907: Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundhttps://agentprime.io/advisories/CVE-2026-82907/https://agentprime.io/advisories/CVE-2026-82907/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:04:07 GMTCVEcriticalCVE-2026-82910: Apache OFBiz: renderLink compiles link parameters as FreeMarker sourcehttps://agentprime.io/advisories/CVE-2026-82910/https://agentprime.io/advisories/CVE-2026-82910/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:03:20 GMTCVECVE-2026-82912: Apache OFBiz: Unsandboxed Groovy compiled from a service parameterhttps://agentprime.io/advisories/CVE-2026-82912/https://agentprime.io/advisories/CVE-2026-82912/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:02:28 GMTCVECVE-2026-82916: Apache OFBiz: webtools xmldsdump exports any entity to any pathhttps://agentprime.io/advisories/CVE-2026-82916/https://agentprime.io/advisories/CVE-2026-82916/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:01:49 GMTCVECVE-2026-82960: Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEhttps://agentprime.io/advisories/CVE-2026-82960/https://agentprime.io/advisories/CVE-2026-82960/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:01:23 GMTCVECVE-2026-83538: Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpershttps://agentprime.io/advisories/CVE-2026-83538/https://agentprime.io/advisories/CVE-2026-83538/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:00:57 GMTCVECVE-2026-83542: Apache OFBiz: Unauthenticated RCE via login-page widget injectionhttps://agentprime.io/advisories/CVE-2026-83542/https://agentprime.io/advisories/CVE-2026-83542/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:59:22 GMTCVEcriticalCVE-2026-84183: Apache OFBiz: Content Manager VIEW-only RCE in updateLayouthttps://agentprime.io/advisories/CVE-2026-84183/https://agentprime.io/advisories/CVE-2026-84183/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:58:58 GMTCVECVE-2026-84728: Apache OFBiz: Cross-tenant authorization bypass in mapped-domain loginhttps://agentprime.io/advisories/CVE-2026-84728/https://agentprime.io/advisories/CVE-2026-84728/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:57:02 GMTCVECVE-2026-85627: Apache OFBiz: Authenticated Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-85627/https://agentprime.io/advisories/CVE-2026-85627/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:53:26 GMTCVECVE-2026-92887: Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationhttps://agentprime.io/advisories/CVE-2026-92887/https://agentprime.io/advisories/CVE-2026-92887/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:45:53 GMTCVECVE-2026-97355: Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servicehttps://agentprime.io/advisories/CVE-2026-97355/https://agentprime.io/advisories/CVE-2026-97355/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:45:25 GMTCVECVE-2026-97356: Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-97356/https://agentprime.io/advisories/CVE-2026-97356/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:44:53 GMTCVECVE-2026-100168: Apache OFBiz: Missing Authorization vulnerabilityhttps://agentprime.io/advisories/CVE-2026-100168/https://agentprime.io/advisories/CVE-2026-100168/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:44:04 GMTCVECVE-2026-100228: Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulationhttps://agentprime.io/advisories/CVE-2026-100228/https://agentprime.io/advisories/CVE-2026-100228/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:43:39 GMTCVECVE-2026-105325: Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationshttps://agentprime.io/advisories/CVE-2026-105325/https://agentprime.io/advisories/CVE-2026-105325/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:40:35 GMTCVECVE-2026-105330: Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Accesshttps://agentprime.io/advisories/CVE-2026-105330/https://agentprime.io/advisories/CVE-2026-105330/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:40:03 GMTCVECVE-2026-105461: Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitieshttps://agentprime.io/advisories/CVE-2026-105461/https://agentprime.io/advisories/CVE-2026-105461/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:39:40 GMTCVECVE-2026-109129: Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modificationhttps://agentprime.io/advisories/CVE-2026-109129/https://agentprime.io/advisories/CVE-2026-109129/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:38:52 GMTCVECVE-2026-109837: Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Associationhttps://agentprime.io/advisories/CVE-2026-109837/https://agentprime.io/advisories/CVE-2026-109837/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:38:04 GMTCVECVE-2026-109856: Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulationhttps://agentprime.io/advisories/CVE-2026-109856/https://agentprime.io/advisories/CVE-2026-109856/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:37:35 GMTCVECVE-2026-109928: Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeoverhttps://agentprime.io/advisories/CVE-2026-109928/https://agentprime.io/advisories/CVE-2026-109928/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:36:52 GMTCVECVE-2026-114229: Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Sessionhttps://agentprime.io/advisories/CVE-2026-114229/https://agentprime.io/advisories/CVE-2026-114229/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:36:15 GMTCVECVE-2026-114233: Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Ordershttps://agentprime.io/advisories/CVE-2026-114233/https://agentprime.io/advisories/CVE-2026-114233/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:35:47 GMTCVECVE-2026-114235: Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modificationhttps://agentprime.io/advisories/CVE-2026-114235/https://agentprime.io/advisories/CVE-2026-114235/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:35:14 GMTCVECVE-2026-114271: Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modificationhttps://agentprime.io/advisories/CVE-2026-114271/https://agentprime.io/advisories/CVE-2026-114271/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:34:26 GMTCVECVE-2026-114272: Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosurehttps://agentprime.io/advisories/CVE-2026-114272/https://agentprime.io/advisories/CVE-2026-114272/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:34:05 GMTCVECVE-2026-114277: Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accountshttps://agentprime.io/advisories/CVE-2026-114277/https://agentprime.io/advisories/CVE-2026-114277/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:33:35 GMTCVECVE-2026-47342: Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypasshttps://agentprime.io/advisories/CVE-2026-47342/https://agentprime.io/advisories/CVE-2026-47342/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 22:29:06 GMTCVECVE-2026-50223: Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-50223/https://agentprime.io/advisories/CVE-2026-50223/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 22:23:49 GMTCVECVE-2026-46586: Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Executionhttps://agentprime.io/advisories/CVE-2026-46586/https://agentprime.io/advisories/CVE-2026-46586/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 09:41:39 GMTCVECVE-2026-45434: Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCEhttps://agentprime.io/advisories/CVE-2026-45434/https://agentprime.io/advisories/CVE-2026-45434/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.21 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 09:40:26 GMTCVEcritical