CVE-2026-35086

MediumCVSS 6.5/10Last modified Nov 3, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
Apache Software FoundationApache OFBiz< 24.09.06

References

Timeline

Published
May 19, 2026
Last modified
Nov 3, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-350879.3Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials bCVE-2026-350888.2Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker CVE-2026-350898.7In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtainCVE-2026-35097.5An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control ruCVE-2026-350909.3In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via CVE-2026-350918.2A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership coCVE-2026-350927.5A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticateCVE-2026-350938.8A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration dCVE-2026-350945.5A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointCVE-2026-350954.8KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its vaCVE-2026-350965.1KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attackeCVE-2026-350976.9KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extende
CVE-2026-35086: Medium severity, CVSS 6.5 | Vulnix