Log in Start free

Dromara

Products

ProductCVEsExploitedLatest
lamp-cloud14–Oct 12, 2026
UJCMS7–Sep 20, 2026
hertzbeat6–Feb 22, 2024
RuoYi-Vue-Plus6–Oct 30, 2026
Jpom5–Nov 2, 2026
skyeye4–Oct 14, 2026
MaxKey4–Aug 11, 2026
orion-visor2–Sep 13, 2026
Sa-Token2–Dec 30, 2025
mayfly-go2–Sep 17, 2026
HuTool2–Jun 15, 2023
J2eeFAST2–May 2, 2023
warm-flow1–Apr 12, 2026
domain-admin1–Nov 3, 2026
Northstar1–Jul 13, 2025
open-capacity-platform1–Apr 17, 2024
RuoYi-Cloud-Plus1–Oct 13, 2026
dataCompare1–Nov 17, 2025

Exploited and recent CVEs

  • CVE-2026-121552 Medium 4.3 domain-admin before 1.6.79 Missing Authorization via getGroupUserList 0.4%
  • CVE-2026-120461 High 8.8 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch 0.4%
  • CVE-2026-120460 High 8.8 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers 0.4%
  • CVE-2026-120201 Critical 9.8 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header 2.2%
  • CVE-2026-119647 Medium 4.3 RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} 0.3%
  • CVE-2026-111605 High 8.1 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController 0.3%
  • CVE-2026-110609 Medium 6.5 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter 0.5%
  • CVE-2026-110107 Medium 4.2 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} 0.3%
  • CVE-2026-110106 Medium 4.2 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} 0.3%
  • CVE-2026-109168 Medium 6.5 lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId 0.2%
  • CVE-2026-109166 Medium 6.5 lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById 0.2%
  • CVE-2026-107781 High 7.4 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById 0.3%
  • CVE-2026-107780 Critical 9.8 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter 2.1%
  • CVE-2026-107779 Critical 9.8 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE 0.5%
  • CVE-2026-94536 Medium 4.3 lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource 0.3%
  • CVE-2026-94535 High 7.1 lamp-cloud through 5.10.0 Unauthorized Notification Deletion 0.5%
  • CVE-2026-94534 High 7.1 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints 0.5%
  • CVE-2026-94533 Medium 6.5 lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file 0.4%
  • CVE-2026-94532 Medium 6.5 lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById 0.4%
  • CVE-2026-93961 Medium 5.3 Dromara UJCMS UserController UserController.java usernameExist improper authorization 0.6%
  • CVE-2026-92993 Medium 6.3 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection 1.5%
  • CVE-2026-92992 Medium 6.3 Dromara mayfly-go AI Assistant ai.go authorization 0.4%
  • CVE-2026-91996 High 7.5 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint 0.5%
  • CVE-2026-91993 Medium 4.3 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list 0.3%
  • CVE-2026-90510 High 8.3 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key 0.5%
  • CVE-2026-90509 High 7.3 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials 0.5%
  • CVE-2026-78140 Medium 4.7 Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine 0.4%
  • CVE-2026-77795 Medium 6.3 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization 0.3%
  • CVE-2026-19758 High 7.3 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal 0.6%
  • CVE-2026-19757 High 7.3 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal 0.6%