Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-81828Apache OFBiz: Server-side request forgery in SurveyWrapper
- CVE-2026-82894Apache OFBiz: Content renderer runs a service name stored on the row
- CVE-2026-82902Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
- CVE-2026-82904Apache OFBiz: Unbounded multi-form row count from a parameter name
- CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
- CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker source
- CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
- CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any path
- CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
- CVE-2026-83538Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
- CVE-2026-83542Apache OFBiz: Unauthenticated RCE via login-page widget injection
- CVE-2026-84183Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
- CVE-2026-84728Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
- CVE-2026-85627Apache OFBiz: Authenticated Code Execution Vulnerability
- CVE-2026-92887Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
- CVE-2026-97355Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
- CVE-2026-97356Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
- CVE-2026-100168Apache OFBiz: Missing Authorization vulnerability
- CVE-2026-100228Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
- CVE-2026-105325Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
- CVE-2026-105330Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
- CVE-2026-105461Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
- CVE-2026-109129Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
- CVE-2026-109837Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
- CVE-2026-109856Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
- CVE-2026-109928Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
- CVE-2026-114229Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
- CVE-2026-114233Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
- CVE-2026-114235Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
- CVE-2026-114271Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification