Daily summary
Vulnerabilities of 5 November 2026: 67 new, 2 critical
67 vulnerabilities added on 5 November 2026, 2 critical and 13 high: Apache OFBiz (46), Sensitive data exposure in WordPress plugins, Denial of service in servers and applications and more.
- 2 critical
- 13 high
- 10 medium
- 6 low
- 36 unrated
Apache OFBiz
46 vulnerabilities · Servers and applications · most fixed in 24.09.08
- 9.8Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
- 9.8Apache OFBiz: Unauthenticated RCE via login-page widget injection
- 8.8Apache OFBiz: renderLink compiles link parameters as FreeMarker source
- 8.8Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
- 8.8Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
Show 41 more
- 8.8Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
- 8.1Apache OFBiz: Dispatch arbitrary internal services on SFA component
- 7.5Apache OFBiz: Unbounded multi-form row count from a parameter name
- 7.1Apache OFBiz: webtools xmldsdump exports any entity to any path
- 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
- 5.4Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
- 4.3Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
- –Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
- –Apache OFBiz: Unauthenticated path-suffix view authorization bypass
- –Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
- –Apache OFBiz: Unauthenticated HR organization and employee disclosure
- –Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
- –Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
- –Apache OFBiz: Missing authorization - catalog quick-admin product writes
- –Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
- –Apache OFBiz: Authorization bypass - self-grant content OWNER
- –Apache OFBiz: Missing authorization - search-result bulk catalog mutation
- –Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
- –Apache OFBiz: XML external entity injection (XXE)
- –Apache OFBiz: Server-side request forgery in SurveyWrapper
- –Apache OFBiz: Content renderer runs a service name stored on the row
- –Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
- –Apache OFBiz: Authenticated Code Execution Vulnerability
- –Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
- –Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
- –Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
- –Apache OFBiz: Missing Authorization vulnerability
- –Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
- –Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
- –Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
- –Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
- –Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
- –Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
- –Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
- –Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
- –Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
- –Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
- –Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
- –Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification
- –Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
- –Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
Sensitive data exposure in WordPress plugins
2 vulnerabilities
Denial of service in servers and applications
3 vulnerabilities
Cross-site scripting in WordPress plugins
4 vulnerabilities
- 6.4Redux FrameworkAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
- 6.4Redux FrameworkAuthenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
- 6.4Customer Reviews for WooCommerceAuthenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
- –PixelyoursitePixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting
Other vulnerabilities in WordPress plugins
2 vulnerabilities
Other vulnerabilities in servers and applications
9 vulnerabilities
- 8.1OpenSSHsshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to…
- 7.1GogsIn Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different…
- 6.3SymfonyIp Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
- 5.3Difylanggenius dify Sandbox Run __init__.py hard-coded credentials
- 3.7ModSecurityModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
Show 4 more
- 2.3Parse ServerParse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
- 2.3Parse ServerObject write with a dot notation key can change a field that a `beforeSave` trigger reverts or keeps constant
- 2.3SymfonyHtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
- 2.3SymfonyNoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342
Elixir and Erlang packages
1 vulnerability
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.