YunaiV yudao-cloud

• CVE-2026-116016 High 7.1 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header 0.3%
• CVE-2026-116015 Medium 4.3 yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint 0.2%
• CVE-2026-58448 Medium 6.5 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API 0.4%
• CVE-2026-9464 Medium 4.7 YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery 0.4%
• CVE-2026-7710 High 7.3 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication 0.4%
• CVE-2026-7679 High 7.3 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication 0.4%
• CVE-2026-7678 Medium 6.3 YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection 0.2%
• CVE-2026-5148 Medium 4.7 YunaiV yudao-cloud page sql injection 0.3%
• CVE-2026-5147 High 7.3 YunaiV yudao-cloud get-by-website sql injection 0.3%
• CVE-2025-15098 Medium 6.3 YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery 0.3%
• CVE-2025-10987 Medium 6.3 YunaiV yudao-cloud HTTP Request transfer improper authorization 0.3%
• CVE-2025-10277 Medium 6.3 YunaiV yudao-cloud submit improper authorization 0.3%
• CVE-2025-10275 Medium 6.3 YunaiV yudao-cloud transfer improper authorization 0.3%