Dromara vulnerabilities
62 CVEs and advisories name Dromara as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121552domain-admin before 1.6.79 Missing Authorization via getGroupUserList
- CVE-2026-120461Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch
- CVE-2026-120460Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers
- CVE-2026-120201Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
- CVE-2026-119647RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
- CVE-2026-111605Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
- CVE-2026-110609Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
- CVE-2026-110107RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- CVE-2026-110106RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- CVE-2026-109168lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
- CVE-2026-109166lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
- CVE-2026-107781Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
- CVE-2026-107780Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
- CVE-2026-107779Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
- CVE-2026-94536lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
- CVE-2026-94535lamp-cloud through 5.10.0 Unauthorized Notification Deletion
- CVE-2026-94534lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
- CVE-2026-94533lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
- CVE-2026-94532lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
- CVE-2026-93961Dromara UJCMS UserController UserController.java usernameExist improper authorization
- CVE-2026-92993Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
- CVE-2026-92992Dromara mayfly-go AI Assistant ai.go authorization
- CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
- CVE-2026-91993Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
- CVE-2026-90510dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
- CVE-2026-90509dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
- CVE-2026-78140Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
- CVE-2026-77795Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
- CVE-2026-19758dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
- CVE-2026-19757Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal