JE
Product
JeecgBoot
113
CVEs
0
On KEV
8.1
Max CVSS
101
New 30D
Severity mix
Critical 0High 6Medium 104Low 3
Watch
Add JeecgBoot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-108657 | 8.1 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply Affected: through 3.9.5 |
| CVE-2026-108628 | 8.1 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint Affected: through 3.9.5 |
| CVE-2026-58377 | 8.1 | Jun 30 | JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys Affected: through 3.9.2 |
| CVE-2026-19000 | 7.3 | Aug 6 | JeecgBoot Anonymous Chat Attachment send server-side request forgery Affected: 3.9.0; 3.9.1; 3.9.2 |
| CVE-2026-9580 | 7.3 | May 26 | JeecgBoot selectDepart LoginController.selectDepart access control Affected: 3.9.0; 3.9.1 |
| CVE-2026-108623 | 7.1 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch Affected: through 3.9.5 |
| CVE-2026-112017 | 6.5 | Oct 18 | JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass Affected: before 3.9.5 |
| CVE-2026-108883 | 6.5 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig Affected: through 3.9.5 |
| CVE-2026-108677 | 6.5 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName Affected: through 3.9.5 |
| CVE-2026-108671 | 6.5 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById Affected: through 3.9.5 |
| CVE-2026-108661 | 6.5 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant Affected: through 3.9.5 |
| CVE-2026-108648 | 6.5 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint Affected: through 3.9.5 |
| CVE-2026-10240 | 6.3 | Jun 1 | JeecgBoot test server-side request forgery Affected: 3.9.0; 3.9.1; 3.9.2 |
| CVE-2026-10239 | 6.3 | Jun 1 | JeecgBoot edit WordUtil.addImage server-side request forgery Affected: 3.9.0; 3.9.1; 3.9.2 |
| CVE-2026-9581 | 6.3 | May 26 | JeecgBoot add access control Affected: 3.9.0; 3.9.1 |
| CVE-2026-9579 | 6.3 | May 26 | JeecgBoot SysUser userEdit user.getUsername access control Affected: 3.9.0; 3.9.1 |
| CVE-2026-108885 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete Affected: through 3.9.5 |
| CVE-2026-108884 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint Affected: through 3.9.5 |
| CVE-2026-108882 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser Affected: through 3.9.5 |
| CVE-2026-108877 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete Affected: through 3.9.5 |
| CVE-2026-108871 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule Affected: through 3.9.5 |
| CVE-2026-108870 | 5.4 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule Affected: through 3.9.5 |
| CVE-2026-108668 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin Affected: through 3.9.5 |
| CVE-2026-108666 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch Affected: through 3.9.5 |
| CVE-2026-108662 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser Affected: through 3.9.5 |
| CVE-2026-108644 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete Affected: through 3.9.5 |
| CVE-2026-108643 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch Affected: through 3.9.5 |
| CVE-2026-108639 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id} Affected: through 3.9.5 |
| CVE-2026-108634 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint Affected: through 3.9.5 |
| CVE-2026-108631 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete Affected: through 3.9.5 |
| CVE-2026-108624 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint Affected: through 3.9.5 |
| CVE-2026-108622 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint Affected: through 3.9.5 |
| CVE-2026-108620 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch Affected: through 3.9.5 |
| CVE-2026-108619 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint Affected: through 3.9.5 |
| CVE-2026-108616 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch Affected: through 3.9.5 |
| CVE-2026-108615 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete Affected: through 3.9.5 |
| CVE-2026-108613 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint Affected: through 3.9.5 |
| CVE-2026-108612 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch Affected: through 3.9.5 |
| CVE-2026-108611 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint Affected: through 3.9.5 |
| CVE-2026-108606 | 5.4 | Oct 10 | JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById Affected: through 3.9.5 |
| CVE-2026-108891 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId Affected: through 3.9.5 |
| CVE-2026-108888 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls Affected: through 3.9.5 |
| CVE-2026-108887 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls Affected: through 3.9.5 |
| CVE-2026-108886 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername Affected: through 3.9.5 |
| CVE-2026-108881 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo Affected: through 3.9.5 |
| CVE-2026-108880 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId Affected: through 3.9.5 |
| CVE-2026-108879 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter Affected: through 3.9.5 |
| CVE-2026-108878 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById Affected: through 3.9.5 |
| CVE-2026-108876 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit Affected: through 3.9.5 |
| CVE-2026-108875 | 4.3 | Oct 11 | JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup Affected: through 3.9.5 |
