{"schema_version":1,"title":"Apache Ofbiz vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Apache Ofbiz: 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-50223, was published on 10 June 2026.","url":"https://junglewise.ai/threats/technologies/ofbiz","json_url":"https://junglewise.ai/threats/technologies/ofbiz.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/ofbiz","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":22,"critical":3,"exploited":3,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":19},"latest":[{"cve":"CVE-2026-50223","cvss":8.8,"slug":"cve-2026-50223-apache-ofbiz-template-injection-in-dataresource-component","title":"Apache OFBiz template injection in DataResource component","severity":"info","exploited":false,"published_at":"2026-06-10T23:16:49.777+00:00","url":"https://junglewise.ai/threats/cve-2026-50223-apache-ofbiz-template-injection-in-dataresource-component"},{"cve":"CVE-2026-47342","cvss":6.5,"slug":"cve-2026-47342-apache-ofbiz-privilege-escalation-in-updateorremove-functionality","title":"Apache OFBiz privilege escalation in updateOrRemove functionality","severity":"info","exploited":false,"published_at":"2026-06-10T23:16:48.507+00:00","url":"https://junglewise.ai/threats/cve-2026-47342-apache-ofbiz-privilege-escalation-in-updateorremove-functionality"},{"cve":"CVE-2026-46586","slug":"cve-2026-46586-apache-ofbiz-code-injection-in-dynamic-evaluation-engine","title":"Apache OFBiz code injection in dynamic evaluation engine","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.733+00:00","url":"https://junglewise.ai/threats/cve-2026-46586-apache-ofbiz-code-injection-in-dynamic-evaluation-engine"},{"cve":"CVE-2026-45434","slug":"cve-2026-45434-apache-ofbiz-remote-code-execution-via-password-change-logic-flaw","title":"Apache OFBiz remote code execution via password-change logic flaw","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.62+00:00","url":"https://junglewise.ai/threats/cve-2026-45434-apache-ofbiz-remote-code-execution-via-password-change-logic-flaw"},{"cve":"CVE-2026-45187","slug":"cve-2026-45187-apache-ofbiz-improper-authorization-in-webtools","title":"Apache OFBiz improper authorization in Webtools","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.5+00:00","url":"https://junglewise.ai/threats/cve-2026-45187-apache-ofbiz-improper-authorization-in-webtools"},{"cve":"CVE-2026-41919","slug":"cve-2026-41919-apache-ofbiz-ldap-injection","title":"Apache OFBiz LDAP injection","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.38+00:00","url":"https://junglewise.ai/threats/cve-2026-41919-apache-ofbiz-ldap-injection"},{"cve":"CVE-2026-35086","slug":"cve-2026-35086-apache-ofbiz-code-injection-in-email-services","title":"Apache OFBiz code injection in email services","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.263+00:00","url":"https://junglewise.ai/threats/cve-2026-35086-apache-ofbiz-code-injection-in-email-services"},{"cve":"CVE-2026-31986","slug":"cve-2026-31986-apache-ofbiz-hard-coded-cryptographic-key","title":"Apache OFBiz hard-coded cryptographic key","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.143+00:00","url":"https://junglewise.ai/threats/cve-2026-31986-apache-ofbiz-hard-coded-cryptographic-key"},{"cve":"CVE-2026-31910","slug":"cve-2026-31910-apache-ofbiz-server-side-request-forgery","title":"Apache OFBiz Server-Side Request Forgery","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.037+00:00","url":"https://junglewise.ai/threats/cve-2026-31910-apache-ofbiz-server-side-request-forgery"},{"cve":"CVE-2026-31909","slug":"cve-2026-31909-apache-ofbiz-sensitive-information-disclosure","title":"Apache OFBiz sensitive information disclosure","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.913+00:00","url":"https://junglewise.ai/threats/cve-2026-31909-apache-ofbiz-sensitive-information-disclosure"},{"cve":"CVE-2026-31906","slug":"cve-2026-31906-apache-ofbiz-cross-site-scripting","title":"Apache OFBiz cross-site scripting","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.777+00:00","url":"https://junglewise.ai/threats/cve-2026-31906-apache-ofbiz-cross-site-scripting"},{"cve":"CVE-2026-31388","slug":"cve-2026-31388-apache-ofbiz-improper-access-control-in-multi-tenant-deployments","title":"Apache OFBiz improper access control in multi-tenant deployments","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.643+00:00","url":"https://junglewise.ai/threats/cve-2026-31388-apache-ofbiz-improper-access-control-in-multi-tenant-deployments"},{"cve":"CVE-2026-31387","slug":"cve-2026-31387-apache-ofbiz-improper-authentication","title":"Apache OFBiz improper authentication","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.5+00:00","url":"https://junglewise.ai/threats/cve-2026-31387-apache-ofbiz-improper-authentication"},{"cve":"CVE-2026-31380","slug":"cve-2026-31380-apache-ofbiz-expression-language-injection","title":"Apache OFBiz Expression Language injection","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.377+00:00","url":"https://junglewise.ai/threats/cve-2026-31380-apache-ofbiz-expression-language-injection"},{"cve":"CVE-2026-31379","slug":"cve-2026-31379-apache-ofbiz-multiple-vulnerabilities-including-xss-and-code","title":"Apache OFBiz multiple vulnerabilities including XSS and Code Injection","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.253+00:00","url":"https://junglewise.ai/threats/cve-2026-31379-apache-ofbiz-multiple-vulnerabilities-including-xss-and-code"},{"cve":"CVE-2026-31378","slug":"cve-2026-31378-apache-ofbiz-improper-input-validation","title":"Apache OFBiz improper input validation","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:23.137+00:00","url":"https://junglewise.ai/threats/cve-2026-31378-apache-ofbiz-improper-input-validation"},{"cve":"CVE-2026-29226","slug":"cve-2026-29226-apache-ofbiz-ssrf-in-content-component","title":"Apache OFBiz SSRF in Content component","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:22.73+00:00","url":"https://junglewise.ai/threats/cve-2026-29226-apache-ofbiz-ssrf-in-content-component"},{"cve":"CVE-2026-29220","slug":"cve-2026-29220-apache-ofbiz-path-traversal-vulnerability","title":"Apache OFBiz path traversal vulnerability","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:22.61+00:00","url":"https://junglewise.ai/threats/cve-2026-29220-apache-ofbiz-path-traversal-vulnerability"},{"cve":"CVE-2026-29207","slug":"cve-2026-29207-apache-ofbiz-template-injection-in-freemarker-engine","title":"Apache OFBiz template injection in FreeMarker engine","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:22.39+00:00","url":"https://junglewise.ai/threats/cve-2026-29207-apache-ofbiz-template-injection-in-freemarker-engine"},{"cve":"CVE-2024-45195","cvss":9.8,"slug":"cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability","title":"Apache OFBiz Forced Browsing Vulnerability","severity":"critical","exploited":true,"published_at":"2025-02-04T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability"},{"cve":"CVE-2024-38856","cvss":9.8,"slug":"cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability","title":"Apache OFBiz Incorrect Authorization Vulnerability","severity":"critical","exploited":true,"published_at":"2024-08-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability"},{"cve":"CVE-2024-32113","cvss":9.8,"slug":"cve-2024-32113-apache-ofbiz-path-traversal-vulnerability","title":"Apache OFBiz Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2024-08-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-32113-apache-ofbiz-path-traversal-vulnerability"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Airflow","slug":"airflow","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache Traffic Server","slug":"traffic-server","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/traffic-server"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Storm","slug":"storm","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/storm"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/apisix"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache ActiveMQ Artemis","slug":"activemq-artemis","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/activemq-artemis"},{"name":"Apache Ranger","slug":"ranger","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/ranger"}],"technology":{"hub":true,"name":"Apache Ofbiz","slug":"ofbiz","vendor":{"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"erp-system","homepage":"https://ofbiz.apache.org/","repo_url":"https://github.com/apache/ofbiz","description":"OFBiz is an open source enterprise resource planning (ERP) system that provides a suite of business applications for automating many enterprise processes.","url":"https://junglewise.ai/threats/technologies/ofbiz"},"most_severe":[{"cve":"CVE-2024-45195","cvss":9.8,"slug":"cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability","title":"Apache OFBiz Forced Browsing Vulnerability","severity":"critical","exploited":true,"published_at":"2025-02-04T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability"},{"cve":"CVE-2024-38856","cvss":9.8,"slug":"cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability","title":"Apache OFBiz Incorrect Authorization Vulnerability","severity":"critical","exploited":true,"published_at":"2024-08-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability"},{"cve":"CVE-2024-32113","cvss":9.8,"slug":"cve-2024-32113-apache-ofbiz-path-traversal-vulnerability","title":"Apache OFBiz Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2024-08-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-32113-apache-ofbiz-path-traversal-vulnerability"},{"cve":"CVE-2026-50223","cvss":8.8,"slug":"cve-2026-50223-apache-ofbiz-template-injection-in-dataresource-component","title":"Apache OFBiz template injection in DataResource component","severity":"info","exploited":false,"published_at":"2026-06-10T23:16:49.777+00:00","url":"https://junglewise.ai/threats/cve-2026-50223-apache-ofbiz-template-injection-in-dataresource-component"},{"cve":"CVE-2026-47342","cvss":6.5,"slug":"cve-2026-47342-apache-ofbiz-privilege-escalation-in-updateorremove-functionality","title":"Apache OFBiz privilege escalation in updateOrRemove functionality","severity":"info","exploited":false,"published_at":"2026-06-10T23:16:48.507+00:00","url":"https://junglewise.ai/threats/cve-2026-47342-apache-ofbiz-privilege-escalation-in-updateorremove-functionality"},{"cve":"CVE-2026-46586","slug":"cve-2026-46586-apache-ofbiz-code-injection-in-dynamic-evaluation-engine","title":"Apache OFBiz code injection in dynamic evaluation engine","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.733+00:00","url":"https://junglewise.ai/threats/cve-2026-46586-apache-ofbiz-code-injection-in-dynamic-evaluation-engine"},{"cve":"CVE-2026-45434","slug":"cve-2026-45434-apache-ofbiz-remote-code-execution-via-password-change-logic-flaw","title":"Apache OFBiz remote code execution via password-change logic flaw","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.62+00:00","url":"https://junglewise.ai/threats/cve-2026-45434-apache-ofbiz-remote-code-execution-via-password-change-logic-flaw"},{"cve":"CVE-2026-45187","slug":"cve-2026-45187-apache-ofbiz-improper-authorization-in-webtools","title":"Apache OFBiz improper authorization in Webtools","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.5+00:00","url":"https://junglewise.ai/threats/cve-2026-45187-apache-ofbiz-improper-authorization-in-webtools"},{"cve":"CVE-2026-41919","slug":"cve-2026-41919-apache-ofbiz-ldap-injection","title":"Apache OFBiz LDAP injection","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.38+00:00","url":"https://junglewise.ai/threats/cve-2026-41919-apache-ofbiz-ldap-injection"},{"cve":"CVE-2026-35086","slug":"cve-2026-35086-apache-ofbiz-code-injection-in-email-services","title":"Apache OFBiz code injection in email services","severity":"info","exploited":false,"published_at":"2026-05-19T10:16:24.263+00:00","url":"https://junglewise.ai/threats/cve-2026-35086-apache-ofbiz-code-injection-in-email-services"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}