Apache security advisories, November 2026

Apache advisories published in November 2026

1. Nov 5, 2026
   High [CVE-2026-82960] Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval, whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection

   High8.8

2. Nov 5, 2026
   High [CVE-2026-84183] Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route

   High8.8

3. Nov 5, 2026
   High [CVE-2026-85627] Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy

   High8.8

4. Nov 5, 2026
   High [CVE-2026-92887] Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a.rest.xml operation

   High

5. Nov 5, 2026
   High [CVE-2026-97356] Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

   High

6. Nov 5, 2026
   High [CVE-2026-100228] Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

   High

7. Nov 5, 2026
   High [CVE-2026-109129] Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification

   High

8. Nov 5, 2026
   High [CVE-2026-109837] Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association

   High

9. Nov 5, 2026
   High [CVE-2026-109856] Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation

   High

10. Nov 5, 2026
    High [CVE-2026-109928] Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover

    High

11. Nov 5, 2026
    High [CVE-2026-114233] Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders

    High

12. Nov 5, 2026
    High [CVE-2026-114277] Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts

    High

13. Nov 5, 2026
    High [CVE-2026-73095] Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau

    High8.7

14. Nov 5, 2026
    Medium [CVE-2026-66903] Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz

    Medium6.5

15. Nov 5, 2026
    Medium [CVE-2026-73580] Apache OFBiz: Unauthenticated HR organization and employee disclosure

    Medium

16. Nov 5, 2026
    Medium [CVE-2026-81734] Apache OFBiz: Missing authorization - catalog quick-admin product writes

    Medium

17. Nov 5, 2026
    Medium [CVE-2026-76152] Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services

    Medium

18. Nov 5, 2026
    Medium [CVE-2026-81808] Apache OFBiz: Missing authorization - search-result bulk catalog mutation

    Medium

19. Nov 5, 2026
    Medium [CVE-2026-82902] Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result

    Medium4.3

20. Nov 5, 2026
    Medium [CVE-2026-83538] Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

    Medium

21. Nov 5, 2026
    Medium [CVE-2026-84728] Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data

    Medium5.4

22. Nov 5, 2026
    Medium [CVE-2026-97355] Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

    Medium

23. Nov 5, 2026
    Medium [CVE-2026-100168] Apache OFBiz: Missing Authorization vulnerability

    Medium

24. Nov 5, 2026
    Medium [CVE-2026-105325] Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

    Medium

25. Nov 5, 2026
    Medium [CVE-2026-105330] Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

    Medium

26. Nov 5, 2026
    Medium [CVE-2026-105461] Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities

    Medium

27. Nov 5, 2026
    Medium [CVE-2026-114229] Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session

    Medium

28. Nov 5, 2026
    Medium [CVE-2026-114235] Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification

    Medium

29. Nov 5, 2026
    Medium [CVE-2026-114271] Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification

    Medium

30. Nov 5, 2026
    Medium [CVE-2026-114272] Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure

    Medium

31. Nov 5, 2026
    Low [CVE-2026-81816] XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response

    Low3.5

32. Nov 5, 2026
    Low [CVE-2026-103866] Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

    Low

33. Nov 5, 2026
    Advisory [CVE-2026-103864] Improper output neutralization for logs in Apache Sling Engine

    Unrated

34. Nov 5, 2026
    Advisory [CVE-2026-103863] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine

    Unrated

35. Nov 4, 2026
    High [CVE-2026-90634] uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption

    High7.3

36. Nov 4, 2026
    High [CVE-2026-90629] uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption

    High7.3

37. Nov 4, 2026
    High [CVE-2026-90628] uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code

    High7.3

38. Nov 4, 2026
    High [CVE-2026-90624] unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write

    High7.3

39. Nov 4, 2026
    High [CVE-2026-59268] out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas

    High7.3

40. Nov 4, 2026
    High [CVE-2026-59264] The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access

    High7.8

41. Nov 4, 2026
    High [CVE-2026-100302] Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request

    High7.1

42. Nov 4, 2026
    High [CVE-2026-115448] Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

    High8.7

43. Nov 4, 2026
    High [CVE-2026-100300] Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable

    High8.7

44. Nov 4, 2026
    High [CVE-2026-100252] Improper Authorization vulnerability in Apache ZooKeeper

    High8.6

45. Nov 4, 2026
    High [CVE-2026-111822] Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

    High

46. Nov 4, 2026
    High [CVE-2026-111821] Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

    High

47. Nov 4, 2026
    Medium [CVE-2026-59267] crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier

    Medium5.8

48. Nov 4, 2026
    Medium [CVE-2026-90632] Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF

    Medium5.5

49. Nov 4, 2026
    Medium [CVE-2026-90627] The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user

    Medium5.5

50. Nov 4, 2026
    Medium [CVE-2026-100235] Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation

    Medium6.0

51. Nov 4, 2026
    Medium [CVE-2026-108949] Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

    Medium6.5

52. Nov 4, 2026
    Low [CVE-2026-90631] Apache OpenOffice documents can contain links

    Low3.3

53. Nov 4, 2026
    Low [CVE-2026-59263] manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user

    Low1.9

54. Nov 4, 2026
    Advisory [CVE-2026-108500] Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups

    Unrated

55. Nov 4, 2026
    Advisory [CVE-2026-103582] Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the.NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0

    Unrated

56. Nov 4, 2026
    Advisory [CVE-2026-108946] Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB

    Unrated

57. Nov 3, 2026
    Advisory [CVE-2026-114442] Apache HertzBeat: incomplete XPath expression validation in aliasFields

    Unrated

58. Nov 3, 2026
    Advisory [CVE-2026-119641] Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

    Unrated

59. Nov 3, 2026
    Advisory [CVE-2026-119724] Apache JClouds: XML External Entity (XXE) in provider-response parsing

    Unrated

60. Nov 2, 2026
    Advisory [CVE-2026-111959] Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

    Unrated

61. Nov 2, 2026
    Advisory [CVE-2026-114364] Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

    Unrated

62. Nov 2, 2026
    Advisory [CVE-2026-113687] Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

    Unrated

63. Nov 2, 2026
    Advisory [CVE-2026-113511] Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

    Unrated

64. Nov 2, 2026
    Advisory [CVE-2026-110535] Apache Syncope: AuthProfile value escalation via self-service update

    Unrated

65. Nov 2, 2026
    Advisory [CVE-2026-109083] Apache Syncope: Remote Code Execution via Flowable JUEL expression

    Unrated

66. Nov 1, 2026
    High [CVE-2026-111089] Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

    High7.6

67. Nov 1, 2026
    High [CVE-2026-95863] Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

    High7.6

68. Nov 1, 2026
    High [CVE-2026-84231] Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

    High7.4

69. Nov 1, 2026
    High [CVE-2026-84170] Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

    High8.3

70. Nov 1, 2026
    High [CVE-2026-83594] Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

    High8.3

71. Nov 1, 2026
    High [CVE-2026-83559] Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

    High7.4

72. Nov 1, 2026
    High [CVE-2026-83539] Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data

    High7.4

73. Nov 1, 2026
    High [CVE-2026-82956] Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name

    High7.6

74. Nov 1, 2026
    High [CVE-2026-82840] Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

    High7.2

75. Nov 1, 2026
    Medium [CVE-2026-84177] Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

    Medium6.3

76. Nov 1, 2026
    Medium [CVE-2026-84172] Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

    Medium6.3

77. Nov 1, 2026
    Medium [CVE-2026-82705] Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

    Medium6.3

78. Nov 1, 2026
    Medium [CVE-2026-82704] Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

    Medium6.9

79. Nov 1, 2026
    Medium [CVE-2026-82557] Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

    Medium6.9

80. Nov 1, 2026
    Medium [CVE-2026-82115] Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource

    Medium6.3

81. Nov 1, 2026
    Low [CVE-2026-87718] Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

    Low2.3

82. Nov 1, 2026
    Low [CVE-2026-82898] Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

    Low2.1

83. Nov 1, 2026
    Low [CVE-2026-82559] Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

    Low2.3

84. Nov 1, 2026
    Low [CVE-2026-82558] Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

    Low2.3

Page 2 of 2 · 84 of 184