Dromara RuoYi-Vue-Plus

• CVE-2026-119647 Medium 4.3 RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} 0.3%
• CVE-2026-110106 Medium 4.2 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} 0.3%
• CVE-2026-77795 Medium 6.3 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization 0.3%
• CVE-2026-58176 Medium 6.5 RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints 0.3%
• CVE-2026-2819 Medium 6.3 Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization 0.3%
• CVE-2025-6925 Medium 5.3 Dromara RuoYi-Vue-Plus Mail MailController.java path traversal 1.1%