Technology · Apache
Apache Ofbiz vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 67 vulnerabilities in Apache Ofbiz: 0 in the last 7 days and 43 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-82894, was published on 5 November 2026. 43 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 43
- Critical, all time
- 3
- Exploited in the wild
- 3
About Apache Ofbiz
Open-source enterprise resource planning system providing integrated business management functionality.
Latest Apache Ofbiz vulnerabilities
- CVE-2026-82894: Apache OFBiz improper authorization in ContentWorkerinfo
- CVE-2026-81828: Apache OFBiz server-side request forgery in SurveyWrapperinfo
- CVE-2026-81816: Apache OFBiz XXE injection in ContentWorkerinfo
- CVE-2026-81815: Apache OFBiz SQL injection in performFind serviceinfo
- CVE-2026-81808: Apache OFBiz missing authorization in ProductSearchEventsinfo
- CVE-2026-81744: Apache OFBiz incorrect authorization in ContentPermissionServicesinfo
- CVE-2026-81734: Apache OFBiz missing authorization in ProductEventsinfo
- CVE-2026-76152: Apache OFBiz path traversal and missing authorization in imageCrop and imageRotateinfo
- CVE-2026-76150: Apache OFBiz path traversal and authorization bypass in replaceImageToExistImageinfo
- CVE-2026-73580: Apache OFBiz missing authorization in getHRChild serviceinfo
- CVE-2026-73578: Apache OFBiz authorization bypass in RequestHandler.renderViewinfo
- CVE-2026-73577: Apache OFBiz authorization bypass in RequestHandlerinfo
- CVE-2026-71901: Apache OFBiz resource injection in SFA componentinfo
- CVE-2026-68524: Apache OFBiz arbitrary code execution via temporary file race conditioninfo
- CVE-2026-66903: Apache OFBiz path traversal in catalog image managementinfo
- CVE-2026-97356: Apache OFBiz path traversal in Label Manager ViewFileinfo
- CVE-2026-97355: Apache OFBiz hard-coded password in AdminServerinfo
- CVE-2026-92887: Apache OFBiz REST API authentication bypass in ModelApiReaderinfo
- CVE-2026-85627: Apache OFBiz server-side template injection in updateLayoutImageinfo
- CVE-2026-84728: Apache OFBiz authorization bypass in multitenancyinfo
- CVE-2026-84183: Apache OFBiz authorization bypass in updateLayoutinfo
- CVE-2026-83542: Apache OFBiz code injection in widget XML renderinginfo
- CVE-2026-83538: Apache OFBiz missing authorization in helper endpointsinfo
- CVE-2026-82960: Apache OFBiz CMS plugin code injection in ModelFormFieldinfo
- CVE-2026-82916: Apache OFBiz missing authorization in XmlDsDumpinfo
Most severe Apache Ofbiz vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-32113: Apache OFBiz Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2025-59118: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…highCVSS 7.3EPSS 1.7%
- CVE-2025-61623: Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users…mediumCVSS 6.5EPSS 0.8%
- CVE-2026-50223: Apache OFBiz template injection in DataResource componentinfoCVSS 8.8
- CVE-2026-47342: Apache OFBiz privilege escalation in updateOrRemove functionalityinfoCVSS 6.5
- CVE-2026-82894: Apache OFBiz improper authorization in ContentWorkerinfo
- CVE-2026-81828: Apache OFBiz server-side request forgery in SurveyWrapperinfo
- CVE-2026-81816: Apache OFBiz XXE injection in ContentWorkerinfo
Vulnerabilities per week
43 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 43 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Ofbiz vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/ofbiz)<a href="https://junglewise.ai/threats/technologies/ofbiz"><img src="https://junglewise.ai/threats/technologies/ofbiz/badge.svg" alt="Apache Ofbiz vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/ofbiz.json, and this page as text at https://junglewise.ai/threats/technologies/ofbiz.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Ofbiz vulnerabilities", https://junglewise.ai/threats/technologies/ofbiz, 13 November 2026.