| CVE-2026-66903 |
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-71901 |
Apache OFBiz: Dispatch arbitrary internal services on SFA component
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-68524 |
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-73577 |
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-73578 |
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-73580 |
Apache OFBiz: Unauthenticated HR organization and employee disclosure
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-74841 |
Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-76150 |
Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81734 |
Apache OFBiz: Missing authorization - catalog quick-admin product writes
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-76152 |
Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81744 |
Apache OFBiz: Authorization bypass - self-grant content OWNER
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81808 |
Apache OFBiz: Missing authorization - search-result bulk catalog mutation
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81815 |
Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81816 |
Apache OFBiz: XML external entity injection (XXE)
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-81828 |
Apache OFBiz: Server-side request forgery in SurveyWrapper
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82894 |
Apache OFBiz: Content renderer runs a service name stored on the row
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82902 |
Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82904 |
Apache OFBiz: Unbounded multi-form row count from a parameter name
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82907 |
Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82910 |
Apache OFBiz: renderLink compiles link parameters as FreeMarker source
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82912 |
Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82916 |
Apache OFBiz: webtools xmldsdump exports any entity to any path
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-82960 |
Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-83538 |
Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-83542 |
Apache OFBiz: Unauthenticated RCE via login-page widget injection
|
Not rated
|
Nov 5, 2026 |