[{"cve_id": "CVE-2026-85627", "known_exploited": false, "description": "Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock ", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:07", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85627"}, {"cve_id": "CVE-2026-92887", "known_exploited": false, "description": "Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation ", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:07", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92887"}, {"cve_id": "CVE-2026-97356", "known_exploited": false, "description": "External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:07", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97356"}, {"cve_id": "CVE-2026-97355", "known_exploited": false, "description": "Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigge", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:07", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97355"}, {"cve_id": "CVE-2026-84728", "known_exploited": false, "description": "Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant ", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:07", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84728"}, {"cve_id": "CVE-2026-82960", "known_exploited": false, "description": "Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:06", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82960"}, {"cve_id": "CVE-2026-83538", "known_exploited": false, "description": "Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records \u2014 including organization, employee, product catalog, and product", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:06", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83538"}, {"cve_id": "CVE-2026-82912", "known_exploited": false, "description": "Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:06", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82912"}, {"cve_id": "CVE-2026-82916", "known_exploited": false, "description": "Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) \u2014 explicitly not ", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:06", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82916"}, {"cve_id": "CVE-2026-83542", "known_exploited": false, "description": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget ", "cvss_score": 0.0, "severity": "medium", "published_date": "2026-11-05T14:17:06", "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83542"}]