https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-50223.htmlhttps://patchthecve.com/cve/CVE-2026-50223.htmlThu, 23 Jul 2026 09:10:00 +0000HIGH 8.8: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.https://patchthecve.com/cve/CVE-2026-47342.htmlhttps://patchthecve.com/cve/CVE-2026-47342.htmlThu, 23 Jul 2026 09:10:00 +0000HIGH 8.8: A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.https://patchthecve.com/cve/CVE-2026-46586.htmlhttps://patchthecve.com/cve/CVE-2026-46586.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.8: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the ihttps://patchthecve.com/cve/CVE-2026-45434.htmlhttps://patchthecve.com/cve/CVE-2026-45434.htmlWed, 14 Oct 2026 20:10:00 +0000CRITICAL 9.8: Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-45187.htmlhttps://patchthecve.com/cve/CVE-2026-45187.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-41919.htmlhttps://patchthecve.com/cve/CVE-2026-41919.htmlWed, 14 Oct 2026 20:10:00 +0000CRITICAL 9.1: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-35086.htmlhttps://patchthecve.com/cve/CVE-2026-35086.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31986.htmlhttps://patchthecve.com/cve/CVE-2026-31986.htmlWed, 14 Oct 2026 20:10:00 +0000CRITICAL 9.1: Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31910.htmlhttps://patchthecve.com/cve/CVE-2026-31910.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.5: Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31909.htmlhttps://patchthecve.com/cve/CVE-2026-31909.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.5: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31906.htmlhttps://patchthecve.com/cve/CVE-2026-31906.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31388.htmlhttps://patchthecve.com/cve/CVE-2026-31388.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 5.3: Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31387.htmlhttps://patchthecve.com/cve/CVE-2026-31387.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 5.3: Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31380.htmlhttps://patchthecve.com/cve/CVE-2026-31380.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-31379.htmlhttps://patchthecve.com/cve/CVE-2026-31379.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.0https://patchthecve.com/cve/CVE-2026-31378.htmlhttps://patchthecve.com/cve/CVE-2026-31378.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-29226.htmlhttps://patchthecve.com/cve/CVE-2026-29226.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.3: Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-29220.htmlhttps://patchthecve.com/cve/CVE-2026-29220.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.https://patchthecve.com/cve/CVE-2026-29207.htmlhttps://patchthecve.com/cve/CVE-2026-29207.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with