Dromara Lamp-cloud vulnerabilities

• dromara lamp-cloud lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId CVE-2026-109168 7.1 HighOctober 12, 2026
• dromara lamp-cloud lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById CVE-2026-109166 7.1 HighOctober 12, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource CVE-2026-94536 5.3 MediumSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Notification Deletion CVE-2026-94535 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints CVE-2026-94534 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file CVE-2026-94533 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById CVE-2026-94532 7.1 HighSeptember 21, 2026
• dromara lamp-cloud lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVE-2026-91996 8.7 HighSeptember 15, 2026
• dromara lamp-cloud dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal CVE-2026-19758 6.9 MediumAugust 13, 2026
• dromara lamp-cloud Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal CVE-2026-19757 6.9 MediumAugust 13, 2026
• dromara lamp-cloud Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal CVE-2026-19756 5.3 MediumAugust 13, 2026
• dromara lamp-cloud LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution CVE-2026-69100 8.7 HighAugust 4, 2026
• dromara lamp-cloud Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine CVE-2026-9498 5.3 MediumMay 25, 2026
• dromara lamp-cloud Dromara lamp-cloud DefUserController pageUser improper authorization CVE-2026-5529 5.3 MediumApril 5, 2026