YU
Product
yudao-cloud
13
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 7Medium 6Low 0
Watch
Add yudao-cloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-10987 | 8.8 | Sep 26 | YunaiV yudao-cloud HTTP Request transfer improper authorization Affected: 2025.09 |
| CVE-2025-10277 | 8.8 | Sep 12 | YunaiV yudao-cloud submit improper authorization Affected: 2025.09 |
| CVE-2025-10275 | 8.8 | Sep 12 | YunaiV yudao-cloud transfer improper authorization Affected: 2025.09 |
| CVE-2026-7710 | 7.3 | May 3 | YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +3 more |
| CVE-2026-7679 | 7.3 | May 3 | YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication Affected: 2026.01 |
| CVE-2026-5147 | 7.3 | Mar 30 | YunaiV yudao-cloud get-by-website sql injection Affected: 2026.01 |
| CVE-2026-116016 New | 7.1 | Oct 24 | yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header Affected: through 2026.09 |
| CVE-2026-58448 | 6.5 | Jun 30 | yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API Affected: before 2026.06 |
| CVE-2026-7678 | 6.3 | May 3 | YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection Affected: 2026.01 |
| CVE-2025-15098 | 6.3 | Dec 26 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery Affected: 2025.0; 2025.1; 2025.2; 2025.3; 2025.4; 2025.5; +6 more |
| CVE-2026-9464 | 4.7 | May 25 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery Affected: 2026.03 |
| CVE-2026-5148 | 4.7 | Mar 30 | YunaiV yudao-cloud page sql injection Affected: 2026.01 |
| CVE-2026-116015 New | 4.3 | Oct 24 | yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint Affected: through 2026.09 |
Showing 13