A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ACCOUNTING_VIEW permission to update or create PaymentApplication records due to missing permission checks. This issue is classified as CWE-425 (Forced Browsing).
Apache OFBiz versions 24.09.06 and 24.09.07 contain a hard-coded cryptographic key vulnerability in JWT token authentication. This flaw allows an unauthenticated attacker with network access to gain full administrative privileges by forging a JWT signed with the default security.token.key. The issue affects deployments upgraded from versions before CVE-2026-31986 that retained their original security.properties with security.internal.sso.enabled set to true. The vulnerability is fixed in version 24.09.08. Users must upgrade and run './gradlew rotateSecretKeys' to replace any existing hard-coded keys.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ORDERMGR_VIEW permission to update orders due to a missing permission check (CWE-425 Forced Browsing). The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the Order Manager component. Authenticated users with only view-level order permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by supplying an orderPaymentPreferenceId of a different order. This issue is fixed in version 24.09.08.
CVE-2026-109837 is an authorization bypass vulnerability in Apache OFBiz versions prior to 24.09.08. It allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control via the createReturnItem service. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a forced browsing vulnerability that allows authenticated users with low privileges to perform unauthorized financial account operations. These operations include creating, modifying, and canceling financial account transactions and balances via direct service requests. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication flaw in the password-reset and login JWT validation process. An attacker who obtains a user's password-reset token through interception or exposure can bypass the intended password-change flow and authenticate directly as that user, potentially gaining full session access including administrative privileges. This issue is fixed in version 24.09.08.
A cross-site scripting (XSS) vulnerability exists in the Catalog image viewer component of Apache OFBiz versions before 24.09.08. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user by crafting a malicious viewImage URL that the user opens within the application. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an incorrect privilege assignment vulnerability in the Order Manager. Authenticated users with only order view permissions (ORDERMGR_VIEW) can modify approved orders, including changing shipping addresses, shipment methods, or appending items with overridden prices. This issue is fixed in version 24.09.08.
CVE-2026-114235 is a forced browsing vulnerability in Apache OFBiz 24.09 versions prior to 24.09.08. It allows an authenticated user with only view access to the Order Manager component to modify shipment tracking numbers of any order by directly accessing the updateTrackingNumber endpoint. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the shopping list services. This flaw allows an authenticated low-privileged user to modify or take ownership of another user's shopping list by supplying the other party's shopping list ID in a request. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization bypass vulnerability in the content viewing component. Authenticated users with role-scoped content view permission can read data of content they are not authorized to access by crafting a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content. This issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the optional Janrain Engage Social Login integration. This flaw allows improper binding of authenticated external identities to local user accounts, potentially enabling unauthorized access. The issue is fixed in version 24.09.08.
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
A phishing campaign uses over 300 fake domains impersonating mostly US financial institutions to target business banking and treasury logins. The phishing sites serve legitimate-looking login pages to first-time visitors but show fake 'account suspended' pages to returning visitors to evade takedown efforts. The campaign leverages Cloudflare to hide hosting details and uses IP tracking to differentiate visitors. This tactic complicates detection and takedown since security teams see only the fake suspended page on repeat visits. The campaign also targets victims in the UK, Australia, and New Zealand.
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
CVE-2026-105321 is a high-severity SQL Injection vulnerability in Kobikom Telecommunications and Informatics Services Inc.'s Kobikom product. The flaw exists due to improper neutralization of special elements in SQL commands, allowing an attacker to inject SQL code. This vulnerability affects versions before KobiPBX-FOP3-SEC-r1. A fix is available in the KobiPBX-FOP3-SEC-r1 release.
Eclipse BaSyx Helm Charts version 2.2.0 with the bundled Keycloak enabled stores the client secret of the 'basyx-technical-user' OAuth2 client in cleartext within a Kubernetes ConfigMap. This secret is accessible to principals with read access to ConfigMaps, such as those with the Kubernetes 'view' ClusterRole, allowing them to obtain an admin-level access token. The bundled Keycloak is disabled by default, and no fixed release of the affected chart version exists. Users are advised to migrate to the 'basyx' chart or deploy without the bundled Keycloak and rotate the client secret.