CveMateVulnerability intelligence

Apache Ofbiz vulnerabilities, page 4

73 vulnerabilities

Known vulnerabilities in Apache Ofbiz, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2026-31387apache software foundationapache ofbiz+15mo ago19-05-2026 09:27

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-29220apache software foundationapache ofbiz+15mo ago19-05-2026 09:16

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-29226apache software foundationapache ofbiz+15mo ago19-05-2026 09:19

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-29207apache software foundationapache ofbiz+15mo ago19-05-2026 09:18

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.CVE-2026-46586apache software foundationapache ofbiz+15mo ago19-05-2026 09:41

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-45187apache software foundationapache ofbiz+15mo ago19-05-2026 09:39

Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-45434apache software foundationapache ofbiz+15mo ago19-05-2026 09:40

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-50223apache software foundationapache ofbiz+14mo ago10-06-2026 22:23

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.CVE-2026-35086apache software foundationapache ofbiz+15mo ago19-05-2026 09:36

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2023-51467apache software foundationapache ofbiz+12y ago26-12-2023 14:46

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code CVE-2023-46819apache software foundationapache ofbiz+12y ago07-11-2023 11:02

Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09 CVE-2023-49070apache software foundationapache ofbiz+12y ago05-12-2023 08:05

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10 CVE-2023-50968apache software foundationapache ofbiz+12y ago26-12-2023 11:45

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.