Tagged “cve.org”
CVEs tagged cve.org, newest first.
45763 CVEsRSS
CVE-2026-105330NoneApache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed wit…
CVE-2026-109129NoneApache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference reco…
CVE-2026-105461NoneApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.
CVE-2026-109837NoneApache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a …
CVE-2026-109928NoneApache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email inter…
CVE-2026-109856NoneApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account tra…
CVE-2026-114271NoneApache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification
Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify an…
CVE-2026-114229NoneApache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in…
CVE-2026-114233NoneApache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the ord…
CVE-2026-114272NoneApache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content th…
CVE-2026-114277NoneApache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user ac…
CVE-2026-114235NoneApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order …
CVE-2026-103866NoneApache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing …
CVE-2026-103863NoneApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttyp…
CVE-2026-103864NoneApache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
CVE-2026-96677Critical· 10.0Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer …
CVE-2026-121489Critical· 10.0Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enab…
CVE-2026-73117Critical· 10.0Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. A…
CVE-2026-73116Critical· 10.0Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different …
CVE-2026-73101Critical· 10.0Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can includ…
CVE-2026-73100Critical· 10.0Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a ser…
CVE-2026-107776Low· 2.2Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission d…
CVE-2026-123033High· 8.3Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-ad…
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-ad…
CVE-2026-123029High· 7.5Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
CVE-2026-123017Medium· 6.5GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
CVE-2026-107786Medium· 6.8CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL inje…
CVE-2026-123025Critical· 9.4An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interp…
CVE-2026-109150High· 7.1WP PageNavi Style <= 1.4 - Stored XSS via CSRF
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via…
CVE-2026-107787Low· 3.1CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFol…
CVE-2026-105259Medium· 6.8Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing X…