CVE Vulnerability Database
Search and browse 419,784 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-73578 | — | — | 0.3% | Nov 5, 2026 | Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms al... |
| CVE-2026-73577 | — | — | 0.3% | Nov 5, 2026 | Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthe... |
| CVE-2026-71901 | HIGH | 8.1 | 0.4% | Nov 5, 2026 | Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user w... |
| CVE-2026-68524 | — | — | 0.2% | Nov 5, 2026 | An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" UR... |
| CVE-2026-66903 | MEDIUM | 6.5 | 0.4% | Nov 5, 2026 | Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Ap... |
| CVE-2026-123032 | HIGH | 7.3 | — | Nov 5, 2026 | A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This a... |
| CVE-2026-119744 | HIGH | 8.8 | — | Nov 5, 2026 | Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that all... |
| CVE-2026-115738 | MEDIUM | 6.5 | — | Nov 5, 2026 | SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker... |
| CVE-2026-106716 | — | — | — | Nov 5, 2026 | ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep... |
| CVE-2026-106715 | — | — | — | Nov 5, 2026 | NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin che... |
| CVE-2026-106714 | — | — | — | Nov 5, 2026 | Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it... |
| CVE-2026-106713 | — | — | — | Nov 5, 2026 | An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dr... |
| CVE-2026-97356 | — | — | — | Nov 5, 2026 | External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 ... |
| CVE-2026-97355 | — | — | — | Nov 5, 2026 | Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows a... |
| CVE-2026-92887 | — | — | — | Nov 5, 2026 | Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through... |
| CVE-2026-85627 | HIGH | 8.8 | — | Nov 5, 2026 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz... |
| CVE-2026-84728 | MEDIUM | 5.4 | — | Nov 5, 2026 | Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enable... |
| CVE-2026-84183 | HIGH | 8.8 | — | Nov 5, 2026 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Ap... |
| CVE-2026-83542 | CRITICAL | 9.8 | — | Nov 5, 2026 | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows ... |
| CVE-2026-83538 | — | — | — | Nov 5, 2026 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to... |
| CVE-2026-82960 | HIGH | 8.8 | — | Nov 5, 2026 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.... |
| CVE-2026-82916 | HIGH | 7.1 | — | Nov 5, 2026 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated ... |
| CVE-2026-82912 | HIGH | 8.8 | — | Nov 5, 2026 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') i... |
| CVE-2026-82910 | HIGH | 8.8 | — | Nov 5, 2026 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenR... |
| CVE-2026-82907 | CRITICAL | 9.8 | — | Nov 5, 2026 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platfor... |