CVE-2026-94536 | Medium | 4.3 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employe… |
CVE-2026-94535 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users'… |
CVE-2026-94534 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify… |
CVE-2026-94533 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachme… |
CVE-2026-94532 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user… |
CVE-2026-93961 | Medium | 5.3 | 2026-09-20 | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/u… |
CVE-2026-92993 | Medium | 6.3 | 2026-09-17 | A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/m… |
CVE-2026-92992 | Medium | 6.3 | 2026-09-17 | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai… |
CVE-2026-91996 | High | 7.5 | 2026-09-15 | lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system… |
CVE-2026-91993 | Medium | 4.3 | 2026-09-15 | Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to acce… |
CVE-2026-90509 | High | 7.3 | 2026-09-13 | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApi… |
CVE-2026-78140 | Medium | 4.7 | 2026-08-23 | A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/Web… |
CVE-2026-77795 | Medium | 6.3 | 2026-08-21 | A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategory… |
CVE-2026-19758 | High | 7.3 | 2026-08-14 | A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the compo… |
CVE-2026-19757 | High | 7.3 | 2026-08-14 | A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component Fi… |
CVE-2026-19756 | Medium | 6.3 | 2026-08-13 | A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code… |
CVE-2026-69102 | Critical | 9.8 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attack… |
CVE-2026-69100 | High | 8.8 | 2026-08-04 | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed… |
CVE-2026-67345 | High | 8.1 | 2026-07-30 | MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that al… |
CVE-2026-58176 | Medium | 6.5 | 2026-06-30 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permissi… |
CVE-2026-9498 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handl… |
CVE-2026-7699 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java… |
CVE-2026-6125 | Medium | 6.3 | 2026-04-12 | A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of t… |
CVE-2026-5529 | Medium | 4.3 | 2026-04-05 | A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component… |
CVE-2026-2954 | Medium | 6.3 | 2026-02-22 | A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the compone… |
CVE-2026-2953 | Medium | 5.4 | 2026-02-22 | A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the comp… |
CVE-2026-2819 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/de… |
CVE-2025-66916 | Critical | 9.4 | 2026-01-08 | The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but… |
CVE-2025-15222 | Medium | 5.0 | 2025-12-30 | A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateF… |
CVE-2025-15117 | Low | 3.1 | 2025-12-28 | A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Execu… |
CVE-2025-13268 | Medium | 6.3 | 2025-11-17 | A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/d… |
CVE-2025-7552 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northst… |
CVE-2025-6925 | Medium | 5.3 | 2025-06-30 | A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-6517 | Medium | 6.3 | 2025-06-23 | A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\… |
CVE-2025-2491 | Low | 2.4 | 2025-03-18 | A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/… |
CVE-2025-2490 | Low | 2.4 | 2025-03-18 | A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/j… |
CVE-2024-12483 | Low | 3.7 | 2024-12-12 | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User… |
CVE-2024-3928 | Medium | 4.3 | 2024-04-18 | A vulnerability was found in Dromara open-capacity-platform 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2023-51653 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The… |
CVE-2023-51389 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuratio… |
CVE-2023-51388 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security p… |
CVE-2023-51650 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulner… |
CVE-2023-51387 | High | 7.2 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be… |
CVE-2022-39337 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-43961 | High | 8.8 | 2023-10-25 | An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2023-31581 | Critical | 9.8 | 2023-10-25 | Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. |
CVE-2023-3276 | Medium | 5.5 | 2023-06-15 | A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the fi… |
CVE-2023-2476 | Low | 3.5 | 2023-05-02 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement… |
CVE-2023-2475 | Low | 3.5 | 2023-05-02 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Mes… |
CVE-2022-4565 | Medium | 4.3 | 2022-12-16 | A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.Zip… |