Ofbiz

This hub aggregates every CVE we track for Ofbiz, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Ofbiz.

• CVE-2026-47342Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass8.8Jun 10, 2026
• CVE-2026-50223Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution8.8Jun 10, 2026
• CVE-2026-46586Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution8.8May 19, 2026
• CVE-2026-45434Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE9.8May 19, 2026
• CVE-2026-45187Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs6.5May 19, 2026
• CVE-2026-41919Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction9.1May 19, 2026
• CVE-2026-35086Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services6.5May 19, 2026
• CVE-2026-31986Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection9.1May 19, 2026
• CVE-2026-31910Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access7.5May 19, 2026
• CVE-2026-31909Apache OFBiz: Unauthenticated Shipment Label Image Disclosure7.5May 19, 2026
• CVE-2026-31906Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters6.1May 19, 2026
• CVE-2026-31388Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature5.3May 19, 2026
• CVE-2026-31387Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation5.3May 19, 2026
• CVE-2026-31380Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass6.5May 19, 2026
• CVE-2026-31379Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager6.1May 19, 2026