Apache Software Foundation Apache OFBiz vulnerabilities and fixes
Exploited and high-severity Apache Software Foundation Apache OFBiz vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 7.1CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any pathFix availableApache Software Foundation Apache OFBiz
1 min read - 8.8CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCERCEFix availableApache Software Foundation Apache OFBiz
1 min read - 8.8CVE-2026-84183Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutFix availableApache Software Foundation Apache OFBiz
1 min read - 7.5CVE-2026-82904Apache OFBiz: Unbounded multi-form row count from a parameter nameFix availableApache Software Foundation Apache OFBiz
1 min read - 9.8CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundFix availableApache Software Foundation Apache OFBiz
1 min read - 8.8CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceFix availableApache Software Foundation Apache OFBiz
1 min read - 8.8CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameterFix availableApache Software Foundation Apache OFBiz
1 min read - 9.8CVE-2026-83542Apache OFBiz: Unauthenticated RCE via login-page widget injectionRCEFix availableApache Software Foundation Apache OFBiz
1 min read