NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-109928 Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platf... 2026-11-05 7.4 NETWORK HIGH NVD
CVE-2026-109856 Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user w... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-109837 Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user ... 2026-11-05 5.4 NETWORK MEDIUM NVD
CVE-2026-109129 Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user... 2026-11-05 5.4 NETWORK MEDIUM NVD
CVE-2026-107912 A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the... 2026-11-05 7.7 LOCAL HIGH NVD
CVE-2026-105461 Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 ... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-105330 Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, netw... 2026-11-05 9.8 NETWORK CRITICAL NVD
CVE-2026-105325 Missing check for  ACCOUNTING_UPDATE /  ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentAp... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-100228 Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permissi... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-100168 Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding onl... 2026-11-05 6.5 NETWORK MEDIUM NVD
CVE-2026-123119 The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass ... 2026-11-05 2.3 NETWORK LOW NVD
CVE-2026-103866 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser ... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-103864 Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to u... 2026-11-05 7.5 NETWORK HIGH NVD
CVE-2026-103863 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and ... 2026-11-05 5.4 NETWORK MEDIUM NVD
CVE-2026-123036 A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field... 2026-11-05 5.5 LOCAL MEDIUM NVD