SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.
A vulnerability has been fixed in the firmware of the Zyxel GS1900-24E network switch, specifically in version 2.90(AAHK.2)C0 and earlier. The issue relates to a security flaw identified as CWE-787. No CVSS score or detailed impact information is provided.
A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-66903 is an authenticated path traversal vulnerability in Apache OFBiz's Catalog Image Management component. It allows an authenticated user to write image files outside the intended directory, potentially leading to unauthorized file writes. This issue affects Apache OFBiz versions before 24.09.08. The vulnerability is fixed in version 24.09.08.
CVE-2026-71901 is a Resource Injection vulnerability in Apache OFBiz that allows an authenticated user with access to the sfa component to override the service used during vcard import and potentially access other services. This issue affects versions before 24.09.08. The vulnerability is fixed in version 24.09.08.
Apache OFBiz before version 24.09.08 contains a code injection vulnerability (CWE-94) that allows an unauthenticated attacker to exploit temporary-file handling and inject a malicious file URI. This causes OFBiz to load an attacker-controlled Screen definition, potentially leading to arbitrary code execution or unauthorized actions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authentication bypass vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to access protected views by appending the protected path as a suffix to a public request path, causing improper authorization. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the RequestHandler.renderView function. This flaw allows remote unauthenticated attackers to bypass request-map authentication by manipulating the _LAST_VIEW_NAME_ value stored in the anonymous session. As a result, protected views and associated business data may be exposed without proper authorization. The issue is fixed in version 24.09.08.
CVE-2026-73580 is a missing authorization vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate sensitive Human Resources data, including department and employee identifiers, position names, and organizational relationships. The issue is fixed in version 24.09.08.
CVE-2026-74841 is an uncontrolled resource consumption vulnerability in Apache OFBiz affecting versions prior to 24.09.08. In multitenant deployments, the application builds a per-tenant delegator name from a user-supplied tenant ID before verifying tenant existence. The internal cache retains all delegator names requested, including invalid ones, allowing an unauthenticated attacker to submit arbitrary tenant IDs and cause unbounded cache growth, leading to increased memory and database load.
A path traversal vulnerability exists in Apache OFBiz through version 24.09.07, allowing a remote authenticated attacker with Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This occurs due to missing authorization checks in the replaceImageToExistImage service and can be exploited via crafted parameters. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests against a base view-level permission, while the underlying event methods perform write operations without verifying the required update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.
CVE-2026-76152 is a path traversal vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote authenticated attacker with Catalog view permission to read arbitrary image-parsable files accessible by the OFBiz process and write re-encoded images to arbitrary writable directories. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization vulnerability in ContentPermissionServices. A remote authenticated attacker with limited content-create permission can exploit this flaw to self-assign the OWNER role on arbitrary content. This occurs because the permission check incorrectly defaults to granting access when no matching ContentPurposeOperation entry is found. The OWNER role enables full control over the content, including update, removal, and status changes. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductSearchEvents. A remote authenticated user with only catalog view permission can bulk-modify product category and feature associations across arbitrary search results. This occurs because the servlet authorizes requests only against the base view-level permission, while underlying event methods perform bulk deletes and inserts without enforcing proper DELETE/CREATE permissions. The issue is fixed in version 24.09.08.
A SQL Injection vulnerability exists in Apache OFBiz versions before 24.09.08 on MySQL/MariaDB-backed deployments. The flaw occurs in the entity engine's generic performFind service when handling ignore-case find requests with crafted values, allowing remote unauthenticated attackers to disclose arbitrary database rows. The issue arises because the input is inlined into SQL text with insufficient escaping for MySQL/MariaDB, enabling payloads to break out of string literals. This vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.
XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-81828 is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz versions before 24.09.08. It allows an authenticated back-office user with catalog permission to specify arbitrary URLs as a product-store survey's template location. This causes the server to fetch and render attacker-controlled content, including internal network resources and local files, without validating the URL scheme or host. The malicious content is then rendered into the HTTP response for any shopper loading the affected survey, resulting in non-blind information disclosure. The issue is fixed in version 24.09.08.