CVE-2026-82960 - Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
CVE ID :CVE-2026-82960 Published : Nov. 5, 2026, 2:17 p.m. | 2 hours, 51 minutes ago Description :Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS...