Skip to contentApache Software Foundation Ofbiz vulnerabilities
- apache software foundation ofbizApache OFBiz: Authenticated Path Traversal in Catalog Image ManagementCVE-2026-669036.5 Medium
- apache software foundation ofbizApache OFBiz: Dispatch arbitrary internal services on SFA componentCVE-2026-719018.1 High
- apache software foundation ofbizApache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition LoadingCVE-2026-68524Public exploit7.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated path-suffix view authorization bypassCVE-2026-73577Public exploit7.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactCVE-2026-735787.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated HR organization and employee disclosureCVE-2026-735805.3 Medium
- apache software foundation ofbizApache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeCVE-2026-748419.1 Critical
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImageCVE-2026-761506.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - catalog quick-admin product writesCVE-2026-817346.5 Medium
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate servicesCVE-2026-761526.5 Medium
- apache software foundation ofbizApache OFBiz: Authorization bypass - self-grant content OWNERCVE-2026-817446.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - search-result bulk catalog mutationCVE-2026-818086.5 Medium
- apache software foundation ofbizApache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBCVE-2026-818159.8 Critical
- apache software foundation ofbizApache OFBiz: XML external entity injection (XXE)CVE-2026-818163.5 Low
- apache software foundation ofbizApache OFBiz: Server-side request forgery in SurveyWrapperCVE-2026-818288.1 High
- apache software foundation ofbizApache OFBiz: Content renderer runs a service name stored on the rowCVE-2026-828947.5 High
- apache ofbizApache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafileCVE-2026-829024.3 Medium
- apache ofbizApache OFBiz: Unbounded multi-form row count from a parameter nameCVE-2026-829047.5 High
- apache ofbizApache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundCVE-2026-829079.8 Critical
- apache ofbizApache OFBiz: renderLink compiles link parameters as FreeMarker sourceCVE-2026-829108.8 High
- apache ofbizApache OFBiz: Unsandboxed Groovy compiled from a service parameterCVE-2026-829128.8 High
- apache ofbizApache OFBiz: webtools xmldsdump exports any entity to any pathCVE-2026-829167.1 High
- apache ofbizApache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCECVE-2026-829608.8 High
- apache ofbizApache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpersCVE-2026-835385.3 Medium
- apache ofbizApache OFBiz: Unauthenticated RCE via login-page widget injectionCVE-2026-83542Public exploit9.8 Critical
- apache ofbizApache OFBiz: Content Manager VIEW-only RCE in updateLayoutCVE-2026-841838.8 High
- apache ofbizApache OFBiz: Cross-tenant authorization bypass in mapped-domain loginCVE-2026-847285.4 Medium
- apache ofbizApache OFBiz: Authenticated Code Execution VulnerabilityCVE-2026-856278.8 High
- apache ofbizApache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationCVE-2026-928877.3 High
- apache ofbizApache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceCVE-2026-973556.5 Medium
- apache ofbizApache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication BypassCVE-2026-973566.5 Medium
- apache software foundation ofbizApache OFBiz: Missing Authorization vulnerabilityCVE-2026-1001686.5 Medium
- apache software foundation ofbizApache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price ManipulationCVE-2026-1002286.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsCVE-2026-1053257.5 High
- apache software foundation ofbizApache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessCVE-2026-1053309.8 Critical
- apache software foundation ofbizApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesCVE-2026-1054617.5 High
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference ModificationCVE-2026-1091295.4 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem AssociationCVE-2026-1098375.4 Medium
- apache ofbizApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance ManipulationCVE-2026-1098566.5 Medium
- apache ofbizApache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverCVE-2026-1099287.4 High
- apache ofbizApache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionCVE-2026-1142296.1 Medium
- apache ofbizApache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved OrdersCVE-2026-1142338.1 High
- apache ofbizApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number ModificationCVE-2026-1142356.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List ModificationCVE-2026-1142716.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content DisclosureCVE-2026-1142726.5 Medium
- apache ofbizApache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsCVE-2026-1142776.5 Medium
- apache ofbizApache OFBiz: Privilege Escalation via updateOrRemove Authorization BypassCVE-2026-473428.8 High
- apache ofbizApache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code ExecutionCVE-2026-502238.8 High
- apache ofbizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code ExecutionCVE-2026-465868.8 High
- apache ofbizApache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCECVE-2026-45434EPSS 21.3%9.8 Critical
- Show olderLoading…