# cve.now: Yunaiv

The newest entries naming Yunaiv as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116007](https://cve.now/CVE-2026-116007.md): YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication (CVSS 6.3)
- [CVE-2026-116006](https://cve.now/CVE-2026-116006.md): YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication (CVSS 6.9)
- [CVE-2026-116016](https://cve.now/CVE-2026-116016.md): yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header (CVSS 7.1)
- [CVE-2026-116015](https://cve.now/CVE-2026-116015.md): yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint (CVSS 5.3)
- [CVE-2026-110610](https://cve.now/CVE-2026-110610.md): ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl (CVSS 5.3)
- [CVE-2026-97325](https://cve.now/CVE-2026-97325.md): YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect (CVSS 5.3)
- [CVE-2026-97324](https://cve.now/CVE-2026-97324.md): YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization (CVSS 6.9)
- [CVE-2026-97323](https://cve.now/CVE-2026-97323.md): YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal (CVSS 5.3)
- [CVE-2026-97322](https://cve.now/CVE-2026-97322.md): YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting (CVSS 5.3)
- [CVE-2026-97321](https://cve.now/CVE-2026-97321.md): YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection (CVSS 5.3)
- [CVE-2026-97320](https://cve.now/CVE-2026-97320.md): YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery (CVSS 5.3)
- [CVE-2026-58448](https://cve.now/CVE-2026-58448.md): yudao-cloud \< 2026.06 - BPM Module Broken Access Control via process-instance API (CVSS 6.5)
- [CVE-2026-13528](https://cve.now/CVE-2026-13528.md): YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal (CVSS 6.9)
- [CVE-2026-9464](https://cve.now/CVE-2026-9464.md): YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery (CVSS 5.1)
- [CVE-2026-7710](https://cve.now/CVE-2026-7710.md): YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication (CVSS 6.9)
- [CVE-2026-7679](https://cve.now/CVE-2026-7679.md): YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication (CVSS 6.9)
- [CVE-2026-7678](https://cve.now/CVE-2026-7678.md): YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection (CVSS 5.3)
- [CVE-2026-5148](https://cve.now/CVE-2026-5148.md): YunaiV yudao-cloud page sql injection (CVSS 5.1)
- [CVE-2026-5147](https://cve.now/CVE-2026-5147.md): YunaiV yudao-cloud get-by-website sql injection (CVSS 6.9)
- [CVE-2025-15098](https://cve.now/CVE-2025-15098.md): YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery (CVSS 5.3)
- [CVE-2025-10988](https://cve.now/CVE-2025-10988.md): YunaiV ruoyi-vue-pro transfer improper authorization (CVSS 5.3)
- [CVE-2025-10987](https://cve.now/CVE-2025-10987.md): YunaiV yudao-cloud HTTP Request transfer improper authorization (CVSS 5.3)
- [CVE-2025-10278](https://cve.now/CVE-2025-10278.md): YunaiV ruoyi-vue-pro transfer improper authorization (CVSS 5.3)
- [CVE-2025-10277](https://cve.now/CVE-2025-10277.md): YunaiV yudao-cloud submit improper authorization (CVSS 5.3)
- [CVE-2025-10276](https://cve.now/CVE-2025-10276.md): YunaiV ruoyi-vue-pro transfer improper authorization (CVSS 5.3)
- [CVE-2025-10275](https://cve.now/CVE-2025-10275.md): YunaiV yudao-cloud transfer improper authorization (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/yunaiv
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.