Debugging and Code Improvements

A Backend Engineer candidate at SAP was shown the following method from a purchase-order service and asked to find the bugs and suggest improvements.

public class PurchaseOrderService {

    private static final SimpleDateFormat DATE_FORMAT = new SimpleDateFormat("yyyy-MM-dd");

    public List<PurchaseOrder> loadPendingOrders(Connection conn, String vendorId) {
        List<PurchaseOrder> orders = new ArrayList<>();
        try {
            Statement stmt = conn.createStatement();
            ResultSet rs = stmt.executeQuery(
                "SELECT id, amount, status, created_at FROM purchase_orders WHERE vendor_id = '" + vendorId + "'");

            while (rs.next()) {
                PurchaseOrder po = new PurchaseOrder();
                po.setId(rs.getString("id"));
                po.setAmount(rs.getBigDecimal("amount"));
                po.setStatus(rs.getString("status"));
                po.setCreatedAt(DATE_FORMAT.parse(rs.getString("created_at")));

                if (po.getStatus() == "PENDING") {
                    orders.add(po);
                }
            }
        } catch (Exception e) {
        }

        return orders;
    }
}

List the bugs you can find, in order of how much production impact each would have, and explain what actually goes wrong for each one and how you'd fix it.