BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Apache

CVE-2026-92887: Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remo

CVE-2026-92887 Nov 5, 2026 Source: Vendor

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, whic

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-92887
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
Showing 1–1 of 1
CVE-2026-92887 BR2026-0000-042585 unclaimed
Credited as Wanxin Yin (yaklang.io)