https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T21:28:06.089032+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-92887 fkie_cve-2026-92887 2026-11-07T21:28:06.091609+00:00

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

 https://db.gcve.eu/vuln/ghsa-8p9x-6h8h-hghw GHSA-8p9x-6h8h-hghw 2026-11-07T21:28:06.091687+00:00

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4357 WID-SEC-W-2026-4357 — Apache OFBiz: Mehrere Schwachstellen 2026-11-07T21:28:06.091718+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen, Bestell- und Zahlungsdaten zu manipulieren oder einen DoS auszulösen.