NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-73577 Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass th... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-71901 Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component ca... 2026-11-05 8.1 NETWORK HIGH NVD
CVE-2026-68524 An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an at... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-66903 Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affe... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-119744 Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker ... 2026-11-05 8.8 NETWORK HIGH NVD
CVE-2026-115738 SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply suc... 2026-11-05 5.4 NETWORK MEDIUM NVD
CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attac... 2026-11-05 8.1 NETWORK HIGH NVD
CVE-2026-97356 External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an aut... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-97355 Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the A... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-92887 Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms all... 2026-11-05 7.3 NETWORK HIGH NVD
CVE-2026-85627 Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all ... 2026-11-05 8.8 NETWORK HIGH NVD
CVE-2026-84728 Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticat... 2026-11-05 5.4 NETWORK MEDIUM NVD
CVE-2026-84183 Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.... 2026-11-05 8.8 NETWORK HIGH NVD
CVE-2026-83542 Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attac... 2026-11-05 9.8 NETWORK CRITICAL NVD