Dromara lamp-cloud

• CVE-2026-109168 Medium 6.5 lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId 0.2%
• CVE-2026-109166 Medium 6.5 lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById 0.2%
• CVE-2026-94536 Medium 4.3 lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource 0.3%
• CVE-2026-94535 High 7.1 lamp-cloud through 5.10.0 Unauthorized Notification Deletion 0.5%
• CVE-2026-94534 High 7.1 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints 0.5%
• CVE-2026-94533 Medium 6.5 lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file 0.4%
• CVE-2026-94532 Medium 6.5 lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById 0.4%
• CVE-2026-91996 High 7.5 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint 0.5%
• CVE-2026-19758 High 7.3 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal 0.6%
• CVE-2026-19757 High 7.3 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal 0.6%
• CVE-2026-19756 Medium 6.3 Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal 0.4%
• CVE-2026-69100 High 8.8 LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution 1.0%
• CVE-2026-9498 Medium 6.3 Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine 0.3%
• CVE-2026-5529 Medium 4.3 Dromara lamp-cloud DefUserController pageUser improper authorization 0.3%