Dromara vulnerabilities

Products

• Lamp-cloud 14
• Hertzbeat 8
• Ujcms 8
• Ruoyi-vue-plus 7
• Jpom 5
• Maxkey 4
• Sa-token 4
• Skyeye 4
• J2eefast 3
• Hutool 2
• Mayfly-go 2
• Orion-visor 2

Newest

• dromara domain-admin domain-admin before 1.6.79 Missing Authorization via getGroupUserList CVE-2026-121552 5.3 MediumNovember 3, 2026
• dromara jpom Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch CVE-2026-120461 8.7 HighNovember 2, 2026
• dromara jpom Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers CVE-2026-120460 8.7 HighNovember 2, 2026
• dromara jpom Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header CVE-2026-120201 9.3 CriticalOctober 31, 2026
• dromara ruoyi-vue-plus RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} CVE-2026-119647 5.3 MediumOctober 30, 2026
• dromara jpom Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController CVE-2026-111605 8.6 HighOctober 16, 2026
• dromara skyeye Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter CVE-2026-110609 7.1 HighOctober 14, 2026
• dromara ruoyi-cloud-plus RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} CVE-2026-110107 2.3 LowOctober 13, 2026
• dromara ruoyi-vue-plus RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} CVE-2026-110106 2.3 LowOctober 13, 2026
• dromara lamp-cloud lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId CVE-2026-109168 7.1 HighOctober 12, 2026
• dromara lamp-cloud lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById CVE-2026-109166 7.1 HighOctober 12, 2026
• dromara skyeye Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById CVE-2026-107781 9.1 CriticalOctober 8, 2026
• dromara skyeye Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter CVE-2026-107780 9.3 CriticalOctober 8, 2026
• dromara skyeye Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE CVE-2026-107779 9.3 CriticalOctober 8, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource CVE-2026-94536 5.3 MediumSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Notification Deletion CVE-2026-94535 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints CVE-2026-94534 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file CVE-2026-94533 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById CVE-2026-94532 7.1 HighSeptember 21, 2026
• dromara ujcms Dromara UJCMS UserController UserController.java usernameExist improper authorization CVE-2026-93961 6.9 MediumSeptember 20, 2026
• dromara mayfly-go Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection CVE-2026-92993 5.3 MediumSeptember 17, 2026
• dromara mayfly-go Dromara mayfly-go AI Assistant ai.go authorization CVE-2026-92992 5.3 MediumSeptember 17, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVE-2026-91996 8.7 HighSeptember 15, 2026
• dromara jpom Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list CVE-2026-91993 5.3 MediumSeptember 15, 2026
• dromara orion-visor dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key CVE-2026-90510 6.9 MediumSeptember 13, 2026
• dromara orion-visor dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials CVE-2026-90509 6.9 MediumSeptember 13, 2026
• dromara ujcms Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine CVE-2026-78140 5.1 MediumAugust 23, 2026
• dromara ruoyi-vue-plus Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization CVE-2026-77795 5.3 MediumAugust 21, 2026
• dromara lamp-cloud dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal CVE-2026-19758 6.9 MediumAugust 13, 2026
• dromara lamp-cloud Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal CVE-2026-19757 6.9 MediumAugust 13, 2026
• dromara lamp-cloud Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal CVE-2026-19756 5.3 MediumAugust 13, 2026
• dromara maxkey MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust CVE-2026-69102 9.3 CriticalAugust 11, 2026
• dromara lamp-cloud LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution CVE-2026-69100 8.7 HighAugust 4, 2026
• dromara maxkey MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft CVE-2026-67345 8.5 HighJuly 30, 2026
• dromara ruoyi-vue-plus RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints CVE-2026-58176 7.1 HighJune 30, 2026
• dromara lamp-cloud Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine CVE-2026-9498 5.3 MediumMay 25, 2026
• dromara maxkey Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection CVE-2026-7699 5.3 MediumMay 3, 2026
• dromara warm-flow Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection CVE-2026-6125 Fix available 5.3 MediumApril 12, 2026
• dromara lamp-cloud Dromara lamp-cloud DefUserController pageUser improper authorization CVE-2026-5529 5.3 MediumApril 5, 2026
• dromara ujcms Dromara UJCMS ImportDataController import-channel importChanel injection CVE-2026-2954 5.3 MediumFebruary 22, 2026
• dromara ujcms Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal CVE-2026-2953 5.3 MediumFebruary 22, 2026
• dromara ruoyi-vue-plus Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization CVE-2026-2819 5.3 MediumFebruary 20, 2026
• dromara ruoyi-vue-plus The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job... CVE-2025-66916 9.4 CriticalJanuary 8, 2026
• dromara sa-token Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization CVE-2025-15222 2.3 LowDecember 30, 2025
• dromara sa-token Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization CVE-2025-15117 2.3 LowDecember 28, 2025
• dromara datacompare Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection CVE-2025-13268 5.3 MediumNovember 17, 2025
• dromara northstar Dromara Northstar Path AuthorizationInterceptor.java preHandle access control CVE-2025-7552 5.3 MediumJuly 13, 2025
• dromara ruoyi-vue-plus Dromara RuoYi-Vue-Plus Mail MailController.java path traversal CVE-2025-6925 6.9 MediumJune 30, 2025
• dromara maxkey Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery CVE-2025-6517 5.3 MediumJune 23, 2025
• dromara ujcms Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting CVE-2025-2491 4.8 MediumMarch 18, 2025
• Show olderLoading…