Tagged “cve.org”
CVEs tagged cve.org, newest first.
45763 CVEsRSS
CVE-2026-122325Low· 3.1eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled…
CVE-2026-122324Low· 3.1SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUI…
CVE-2026-122327Medium· 4.3Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can se…
CVE-2026-106716NoneReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. Afte…
CVE-2026-48175Medium· 5.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.
CVE-2026-106715NoneNewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the …
CVE-2026-106714NoneChewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge J…
CVE-2026-106713NoneAn issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component
CVE-2026-71901High· 8.1Apache OFBiz: Dispatch arbitrary internal services on SFA component
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issu…
CVE-2026-68524NoneApache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.0…
CVE-2026-73577NoneApache OFBiz: Unauthenticated path-suffix view authorization bypass
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a …
CVE-2026-81734NoneApache OFBiz: Missing authorization - catalog quick-admin product writes
Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature ass…
CVE-2026-73578NoneApache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplyi…
CVE-2026-74841NoneApache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal…
CVE-2026-76152NoneApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-p…
CVE-2026-73580NoneApache OFBiz: Unauthenticated HR organization and employee disclosure
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including departmen…
CVE-2026-76150NoneApache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary file…
CVE-2026-81744NoneApache OFBiz: Authorization bypass - self-grant content OWNER
Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary…
CVE-2026-81808NoneApache OFBiz: Missing authorization - search-result bulk catalog mutation
Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations acro…
CVE-2026-81815NoneApache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by sub…
CVE-2026-81828NoneApache OFBiz: Server-side request forgery in SurveyWrapper
Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — in…
CVE-2026-82894NoneApache OFBiz: Content renderer runs a service name stored on the row
Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbit…
CVE-2026-83538NoneApache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by …
CVE-2026-85627High· 8.8Apache OFBiz: Authenticated Code Execution Vulnerability
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrativ…
CVE-2026-97355NoneApache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthentica…
CVE-2026-92887NoneApache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing…
CVE-2026-97356NoneApache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary proper…
CVE-2026-100168NoneApache OFBiz: Missing Authorization vulnerability
Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent conten…
CVE-2026-105325NoneApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to ve…
CVE-2026-100228NoneApache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, byp…