# Apache Ofbiz vulnerabilities Source: https://junglewise.ai/threats/technologies/ofbiz Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/ofbiz.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in Apache Ofbiz: 0 in the last 7 days and 43 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-82894, was published on 5 November 2026. 43 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 43 - Last 90 days: 43 - All time: 67 (3 critical, 3 exploited in the wild) ## About Apache Ofbiz Open-source enterprise resource planning system providing integrated business management functionality. ## Latest Apache Ofbiz vulnerabilities - [CVE-2026-82894: Apache OFBiz improper authorization in ContentWorker](https://junglewise.ai/threats/cve-2026-82894-improper-authorization-in-contentworker-in-apache-ofbiz-24-09) (info, published 5 Nov 2026) - [CVE-2026-81828: Apache OFBiz server-side request forgery in SurveyWrapper](https://junglewise.ai/threats/cve-2026-81828-server-side-request-forgery-in-surveywrapper-in-apache-ofbiz-24) (info, published 5 Nov 2026) - [CVE-2026-81816: Apache OFBiz XXE injection in ContentWorker](https://junglewise.ai/threats/cve-2026-81816-xml-external-entity-xxe-injection-in-contentworker-in-apache) (info, published 5 Nov 2026) - [CVE-2026-81815: Apache OFBiz SQL injection in performFind service](https://junglewise.ai/threats/cve-2026-81815-sql-injection-in-the-entity-engine-s-generic-performfind-service) (info, published 5 Nov 2026) - [CVE-2026-81808: Apache OFBiz missing authorization in ProductSearchEvents](https://junglewise.ai/threats/cve-2026-81808-missing-authorization-in-productsearchevents-in-apache-ofbiz-24) (info, published 5 Nov 2026) - [CVE-2026-81744: Apache OFBiz incorrect authorization in ContentPermissionServices](https://junglewise.ai/threats/cve-2026-81744-incorrect-authorization-in-contentpermissionservices-in-apache) (info, published 5 Nov 2026) - [CVE-2026-81734: Apache OFBiz missing authorization in ProductEvents](https://junglewise.ai/threats/cve-2026-81734-missing-authorization-in-productevents-in-apache-ofbiz-24-09) (info, published 5 Nov 2026) - [CVE-2026-76152: Apache OFBiz path traversal and missing authorization in imageCrop and imageRotate](https://junglewise.ai/threats/cve-2026-76152-path-traversal-and-missing-authorization-check-in-the-imagecrop) (info, published 5 Nov 2026) - [CVE-2026-76150: Apache OFBiz path traversal and authorization bypass in replaceImageToExistImage](https://junglewise.ai/threats/cve-2026-76150-path-traversal-and-missing-authorization-check-in-the) (info, published 5 Nov 2026) - [CVE-2026-73580: Apache OFBiz missing authorization in getHRChild service](https://junglewise.ai/threats/cve-2026-73580-missing-authorization-check-in-the-gethrchild-service-in-apache) (info, published 5 Nov 2026) - [CVE-2026-73578: Apache OFBiz authorization bypass in RequestHandler.renderView](https://junglewise.ai/threats/cve-2026-73578-missing-authorization-enforcement-in-requesthandler-renderview-in) (info, published 5 Nov 2026) - [CVE-2026-73577: Apache OFBiz authorization bypass in RequestHandler](https://junglewise.ai/threats/cve-2026-73577-incorrect-authorization-in-requesthandler-in-apache-ofbiz-24-09) (info, published 5 Nov 2026) - [CVE-2026-71901: Apache OFBiz resource injection in SFA component](https://junglewise.ai/threats/cve-2026-71901-improper-control-of-resource-identifiers-resource-injection) (info, published 5 Nov 2026) - [CVE-2026-68524: Apache OFBiz arbitrary code execution via temporary file race condition](https://junglewise.ai/threats/cve-2026-68524-an-unauthenticated-attacker-can-exploit-temporary-file-handling) (info, published 5 Nov 2026) - [CVE-2026-66903: Apache OFBiz path traversal in catalog image management](https://junglewise.ai/threats/cve-2026-66903-authenticated-path-traversal-in-catalog-image-management-allows) (info, published 5 Nov 2026) - [CVE-2026-97356: Apache OFBiz path traversal in Label Manager ViewFile](https://junglewise.ai/threats/cve-2026-97356-external-control-of-file-name-or-path-vulnerability-in-the) (info, published 5 Nov 2026) - [CVE-2026-97355: Apache OFBiz hard-coded password in AdminServer](https://junglewise.ai/threats/cve-2026-97355-use-of-hard-coded-password-vulnerability-in-the-adminserver) (info, published 5 Nov 2026) - [CVE-2026-92887: Apache OFBiz REST API authentication bypass in ModelApiReader](https://junglewise.ai/threats/cve-2026-92887-incorrect-default-value-in-the-rest-api-framework-s-rest-xml) (info, published 5 Nov 2026) - [CVE-2026-85627: Apache OFBiz server-side template injection in updateLayoutImage](https://junglewise.ai/threats/cve-2026-85627-improper-neutralization-of-special-elements-used-in-a-template) (info, published 5 Nov 2026) - [CVE-2026-84728: Apache OFBiz authorization bypass in multitenancy](https://junglewise.ai/threats/cve-2026-84728-incorrect-authorization-in-apache-ofbiz-24-09-before-24-09-08-on) (info, published 5 Nov 2026) - [CVE-2026-84183: Apache OFBiz authorization bypass in updateLayout](https://junglewise.ai/threats/cve-2026-84183-incorrect-authorization-in-the-updatelayout-simple-method-in) (info, published 5 Nov 2026) - [CVE-2026-83542: Apache OFBiz code injection in widget XML rendering](https://junglewise.ai/threats/cve-2026-83542-improper-control-of-generation-of-code-code-injection-in-apache) (info, published 5 Nov 2026) - [CVE-2026-83538: Apache OFBiz missing authorization in helper endpoints](https://junglewise.ai/threats/cve-2026-83538-missing-authorization-in-apache-ofbiz-24-09-before-24-09-08-on) (info, published 5 Nov 2026) - [CVE-2026-82960: Apache OFBiz CMS plugin code injection in ModelFormField](https://junglewise.ai/threats/cve-2026-82960-improper-control-of-generation-of-code-code-injection-in) (info, published 5 Nov 2026) - [CVE-2026-82916: Apache OFBiz missing authorization in XmlDsDump](https://junglewise.ai/threats/cve-2026-82916-missing-authorization-in-xmldsdump-in-apache-ofbiz-24-09-before) (info, published 5 Nov 2026) ## Most severe Apache Ofbiz vulnerabilities - [CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability](https://junglewise.ai/threats/cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 4 Feb 2025) - [CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerability](https://junglewise.ai/threats/cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 27 Aug 2024) - [CVE-2024-32113: Apache OFBiz Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-32113-apache-ofbiz-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 7 Aug 2024) - [CVE-2025-59118: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…](https://junglewise.ai/threats/cve-2025-59118-unrestricted-upload-of-file-with-dangerous-type-vulnerability-in) (high, CVSS 7.3, published 12 Nov 2025) - [CVE-2025-61623: Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users…](https://junglewise.ai/threats/cve-2025-61623-reflected-cross-site-scripting-vulnerability-in-apache-ofbiz-this) (medium, CVSS 6.5, published 12 Nov 2025) - [CVE-2026-50223: Apache OFBiz template injection in DataResource component](https://junglewise.ai/threats/cve-2026-50223-apache-ofbiz-template-injection-in-dataresource-component) (info, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-47342: Apache OFBiz privilege escalation in updateOrRemove functionality](https://junglewise.ai/threats/cve-2026-47342-apache-ofbiz-privilege-escalation-in-updateorremove-functionality) (info, CVSS 6.5, published 10 Jun 2026) - [CVE-2026-82894: Apache OFBiz improper authorization in ContentWorker](https://junglewise.ai/threats/cve-2026-82894-improper-authorization-in-contentworker-in-apache-ofbiz-24-09) (info, published 5 Nov 2026) - [CVE-2026-81828: Apache OFBiz server-side request forgery in SurveyWrapper](https://junglewise.ai/threats/cve-2026-81828-server-side-request-forgery-in-surveywrapper-in-apache-ofbiz-24) (info, published 5 Nov 2026) - [CVE-2026-81816: Apache OFBiz XXE injection in ContentWorker](https://junglewise.ai/threats/cve-2026-81816-xml-external-entity-xxe-injection-in-contentworker-in-apache) (info, published 5 Nov 2026) ## Vulnerabilities per week 43 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 43 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities - [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache Ofbiz vulnerabilities", https://junglewise.ai/threats/technologies/ofbiz, 13 November 2026.