Apache OFBiz versions 24.09.06 and 24.09.07 contain a hard-coded cryptographic key vulnerability in JWT token authentication. This flaw allows an unauthenticated attacker with network access to gain full administrative privileges by forging a JWT signed with the default security.token.key. The issue affects deployments upgraded from versions before CVE-2026-31986 that retained their original security.properties with security.internal.sso.enabled set to true. The vulnerability is fixed in version 24.09.08. Users must upgrade and run './gradlew rotateSecretKeys' to replace any existing hard-coded keys.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ORDERMGR_VIEW permission to update orders due to a missing permission check (CWE-425 Forced Browsing). The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the Order Manager component. Authenticated users with only view-level order permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by supplying an orderPaymentPreferenceId of a different order. This issue is fixed in version 24.09.08.
CVE-2026-109837 is an authorization bypass vulnerability in Apache OFBiz versions prior to 24.09.08. It allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control via the createReturnItem service. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a forced browsing vulnerability that allows authenticated users with low privileges to perform unauthorized financial account operations. These operations include creating, modifying, and canceling financial account transactions and balances via direct service requests. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication flaw in the password-reset and login JWT validation process. An attacker who obtains a user's password-reset token through interception or exposure can bypass the intended password-change flow and authenticate directly as that user, potentially gaining full session access including administrative privileges. This issue is fixed in version 24.09.08.
A cross-site scripting (XSS) vulnerability exists in the Catalog image viewer component of Apache OFBiz versions before 24.09.08. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user by crafting a malicious viewImage URL that the user opens within the application. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an incorrect privilege assignment vulnerability in the Order Manager. Authenticated users with only order view permissions (ORDERMGR_VIEW) can modify approved orders, including changing shipping addresses, shipment methods, or appending items with overridden prices. This issue is fixed in version 24.09.08.
CVE-2026-114235 is a forced browsing vulnerability in Apache OFBiz 24.09 versions prior to 24.09.08. It allows an authenticated user with only view access to the Order Manager component to modify shipment tracking numbers of any order by directly accessing the updateTrackingNumber endpoint. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the shopping list services. This flaw allows an authenticated low-privileged user to modify or take ownership of another user's shopping list by supplying the other party's shopping list ID in a request. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization bypass vulnerability in the content viewing component. Authenticated users with role-scoped content view permission can read data of content they are not authorized to access by crafting a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content. This issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the optional Janrain Engage Social Login integration. This flaw allows improper binding of authenticated external identities to local user accounts, potentially enabling unauthorized access. The issue is fixed in version 24.09.08.
CVE-2026-123023 is an authorization flaw in agentscope-ai AgentScope versions 2.0.0 through 2.0.8 affecting the check_permissions function in the Bash Tool component. This vulnerability allows remote attackers to bypass proper authorization checks. Exploit code has been published publicly. Upgrading to version 2.0.9 addresses the issue.
CVE-2026-117691 is a critical vulnerability in the SAML HTTP-Redirect binding implementation of the Red Hat build of Keycloak. The flaw arises because the server processes percent-encoded parameter names while the signature verification only checks literal names. This discrepancy allows an attacker to submit a crafted unsigned SAML message that the server accepts as valid, enabling full account takeover of federated users.
A vulnerability in the Quarkus framework's quarkus-vertx-http component allows bypassing authorization checks on management endpoints due to improper path concatenation. This flaw lets attackers gain unauthorized access to sensitive management data and perform configuration changes. The issue arises from security policies being applied to incorrect internal paths, leading to a complete bypass of intended authorization rules.
A phishing campaign uses over 300 fake domains impersonating mostly US financial institutions to target business banking and treasury logins. The phishing sites serve legitimate-looking login pages to first-time visitors but show fake 'account suspended' pages to returning visitors to evade takedown efforts. The campaign leverages Cloudflare to hide hosting details and uses IP tracking to differentiate visitors. This tactic complicates detection and takedown since security teams see only the fake suspended page on repeat visits. The campaign also targets victims in the UK, Australia, and New Zealand.
CVE-2026-123022 is an OS command injection vulnerability in agentscope-ai AgentScope versions 2.0.0 through 2.0.11. It affects the subprocess.Popen function in the MCP Workspace API component, allowing remote attackers to inject operating system commands via manipulated arguments. Public exploit code is available, but a fix is pending acceptance of a pull request.
CVE-2026-105321 is a high-severity SQL Injection vulnerability in Kobikom Telecommunications and Informatics Services Inc.'s Kobikom product. The flaw exists due to improper neutralization of special elements in SQL commands, allowing an attacker to inject SQL code. This vulnerability affects versions before KobiPBX-FOP3-SEC-r1. A fix is available in the KobiPBX-FOP3-SEC-r1 release.
Eclipse BaSyx Helm Charts version 2.2.0 with the bundled Keycloak enabled stores the client secret of the 'basyx-technical-user' OAuth2 client in cleartext within a Kubernetes ConfigMap. This secret is accessible to principals with read access to ConfigMaps, such as those with the Kubernetes 'view' ClusterRole, allowing them to obtain an admin-level access token. The bundled Keycloak is disabled by default, and no fixed release of the affected chart version exists. Users are advised to migrate to the 'basyx' chart or deploy without the bundled Keycloak and rotate the client secret.
CVE-2026-104720 is a path traversal vulnerability in Kobikom Telecommunications and Informatics Services Inc.'s Kobikom product. The flaw allows an attacker to access files outside the intended restricted directory. This vulnerability affects versions before KobiPBX-FOP3-SEC-r1. It has a high severity with a CVSS score of 7.5. A fixed version, KobiPBX-FOP3-SEC-r1, is available.