| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16507 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16506 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16505 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16504 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16503 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16502 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16501 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16500 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16499 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16498 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16497 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16496 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16495 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16494 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16493 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16492 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16491 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16490 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16489 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16488 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16487 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16486 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16485 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16484 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16483 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16482 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16481 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16480 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16479 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16478 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16477 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16476 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16475 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16474 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16473 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16472 | — | 0.00 | — | — | Nov 5, 2026 | Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 | ||
| CVE-2019-16447 | Hig | 0.51 | 7.8 | 0.00 | Nov 5, 2026 | Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution. | ||
| CVE-2026-82894 | 0.00 | — | 0.00 | Nov 5, 2026 | Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion,… | |||
| CVE-2026-81828 | 0.00 | — | 0.00 | Nov 5, 2026 | Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and… | |||
| CVE-2026-81816 | 0.00 | — | 0.00 | Nov 5, 2026 | XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted… | |||
| CVE-2026-81815 | 0.00 | — | 0.00 | Nov 5, 2026 | SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g.… | |||
| CVE-2026-81808 | 0.00 | — | 0.00 | Nov 5, 2026 | Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a… | |||
| CVE-2026-81744 | 0.00 | — | 0.00 | Nov 5, 2026 | Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole… | |||
| CVE-2026-81734 | 0.00 | — | 0.00 | Nov 5, 2026 | Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association… | |||
| CVE-2026-76152 | 0.00 | — | 0.00 | Nov 5, 2026 | Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz… | |||
| CVE-2026-76150 | 0.00 | — | 0.00 | Nov 5, 2026 | Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with… | |||
| CVE-2026-74841 | 0.00 | — | 0.00 | Nov 5, 2026 | In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is… | |||
| CVE-2026-73580 | 0.00 | — | 0.00 | Nov 5, 2026 | Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment… | |||
| CVE-2026-73578 | 0.00 | — | 0.00 | Nov 5, 2026 | Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which… | |||
| CVE-2026-73577 | 0.00 | — | 0.00 | Nov 5, 2026 | Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g.,… |
- CVE-2019-16507Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16506Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16505Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16504Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16503Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16502Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16501Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16500Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16499Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16498Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16497Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16496Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16495Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16494Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16493Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16492Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16491Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16490Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16489Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16488Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16487Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16486Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16485Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16484Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16483Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16482Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16481Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16480Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16479Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16478Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16477Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16476Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16475Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16474Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16473Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- CVE-2019-16472Nov 5, 2026risk 0.00cvss —epss —
Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05
- risk 0.51cvss 7.8epss 0.00
Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution.
- CVE-2026-82894Nov 5, 2026risk 0.00cvss —epss 0.00
Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion,…
- CVE-2026-81828Nov 5, 2026risk 0.00cvss —epss 0.00
Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and…
- CVE-2026-81816Nov 5, 2026risk 0.00cvss —epss 0.00
XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted…
- CVE-2026-81815Nov 5, 2026risk 0.00cvss —epss 0.00
SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g.…
- CVE-2026-81808Nov 5, 2026risk 0.00cvss —epss 0.00
Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a…
- CVE-2026-81744Nov 5, 2026risk 0.00cvss —epss 0.00
Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole…
- CVE-2026-81734Nov 5, 2026risk 0.00cvss —epss 0.00
Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association…
- CVE-2026-76152Nov 5, 2026risk 0.00cvss —epss 0.00
Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz…
- CVE-2026-76150Nov 5, 2026risk 0.00cvss —epss 0.00
Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with…
- CVE-2026-74841Nov 5, 2026risk 0.00cvss —epss 0.00
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is…
- CVE-2026-73580Nov 5, 2026risk 0.00cvss —epss 0.00
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment…
- CVE-2026-73578Nov 5, 2026risk 0.00cvss —epss 0.00
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which…
- CVE-2026-73577Nov 5, 2026risk 0.00cvss —epss 0.00
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g.,…