CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceApache Software Foundation Apache OFBiz
- CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameterApache Software Foundation Apache OFBiz
- CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any pathApache Software Foundation Apache OFBiz
- CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEApache Software Foundation Apache OFBiz
- CVE-2026-83538Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpersApache Software Foundation Apache OFBiz
- CVE-2026-123028itsourcecode Online Book Store admin_edit.php sql injectionitsourcecode Online Book Store
- CVE-2026-83542Apache OFBiz: Unauthenticated RCE via login-page widget injectionApache Software Foundation Apache OFBiz
- CVE-2026-84183Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutApache Software Foundation Apache OFBiz
- CVE-2026-84728Apache OFBiz: Cross-tenant authorization bypass in mapped-domain loginApache Software Foundation Apache OFBiz
- CVE-2026-85627Apache OFBiz: Authenticated Code Execution VulnerabilityApache Software Foundation Apache OFBiz
- CVE-2026-76563HTML Injection in FileorbisFileorbis Informatics Services Trade Fileorbis
- CVE-2026-92887Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationApache Software Foundation Apache OFBiz
- CVE-2026-97355Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceApache Software Foundation Apache OFBiz
- CVE-2026-123024agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authenticationagentscope-ai AgentScope
- CVE-2026-97356Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication BypassApache Software Foundation Apache OFBiz
- CVE-2026-100168Apache OFBiz: Missing Authorization vulnerabilityApache Software Foundation Apache OFBiz
- CVE-2026-100228Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price ManipulationApache Software Foundation Apache OFBiz
- CVE-2026-105325Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsApache Software Foundation Apache OFBiz
- CVE-2026-105330Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessApache Software Foundation Apache OFBiz
- CVE-2026-105461Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesApache Software Foundation Apache OFBiz
- CVE-2026-109129Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference ModificationApache Software Foundation Apache OFBiz
- CVE-2026-109837Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem AssociationApache Software Foundation Apache OFBiz
- CVE-2026-109856Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance ManipulationApache Software Foundation Apache OFBiz
- CVE-2026-109928Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverApache Software Foundation Apache OFBiz
- CVE-2026-114229Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionApache Software Foundation Apache OFBiz
- CVE-2026-114233Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved OrdersApache Software Foundation Apache OFBiz
- CVE-2026-114235Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number ModificationApache Software Foundation Apache OFBiz
- CVE-2026-114271Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List ModificationApache Software Foundation Apache OFBiz
- CVE-2026-114272Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content DisclosureApache Software Foundation Apache OFBiz
- CVE-2026-114277Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsApache Software Foundation Apache OFBiz