Login Request a demo
DR
Vendor
dromara
14 products with CVEs on record
44
CVEs
0
On KEV
9
New 30D
Products
SK
skyeye
dromara
9.8
4 CVEs0 on KEV4 new
RU
RuoYi-Vue-Plus
dromara
9.4
6 CVEs0 on KEV1 new
LA
lamp-cloud
dromara
8.8
14 CVEs0 on KEV2 new
JP
Jpom
dromara
8.1
2 CVEs0 on KEV1 new
RU
RuoYi-Cloud-Plus
dromara
4.2
1 CVEs0 on KEV1 new
MA
MaxKey
dromara
9.8
4 CVEs0 on KEV0 new
SA
Sa-Token
Dromara
9.8
4 CVEs0 on KEV0 new
MA
mayfly-go
Dromara
6.3
2 CVEs0 on KEV0 new
OR
orion-visor
dromara
8.3
2 CVEs0 on KEV0 new
DA
dataCompare
Dromara
6.3
1 CVEs0 on KEV0 new
HU
Hutool
Dromara
7.5
1 CVEs0 on KEV0 new
NO
Northstar
Dromara
6.3
1 CVEs0 on KEV0 new
SU
Sureness
Dromara
9.8
1 CVEs0 on KEV0 new
WA
warm-flow
Dromara
6.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-111605
JP
Jpom
dromara
8.1
0%
Oct 16Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
CVE-2026-110609
SK
skyeye
dromara
6.5
0%
Oct 14Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
CVE-2026-110107
RU
RuoYi-Cloud-Plus
dromara
4.2
0%
Oct 13RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110106
RU
RuoYi-Vue-Plus
dromara
4.2
0%
Oct 13RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-109168
LA
lamp-cloud
dromara
6.5
0%
Oct 12lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
CVE-2026-109166
LA
lamp-cloud
dromara
6.5
0%
Oct 12lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
CVE-2026-107781
SK
skyeye
dromara
7.4
0%
Oct 8Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
CVE-2026-107780
SK
skyeye
dromara
9.8
2%
Oct 8Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
CVE-2026-107779
SK
skyeye
dromara
9.8
1%
Oct 8Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
CVE-2026-94536
LA
lamp-cloud
dromara
4.3
0%
Sep 21lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
CVE-2026-94535
LA
lamp-cloud
dromara
7.1
0%
Sep 21lamp-cloud through 5.10.0 Unauthorized Notification Deletion
CVE-2026-94534
LA
lamp-cloud
dromara
7.1
0%
Sep 21lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
CVE-2026-94533
LA
lamp-cloud
dromara
6.5
0%
Sep 21lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
CVE-2026-94532
LA
lamp-cloud
dromara
6.5
0%
Sep 21lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
CVE-2026-92993
MA
mayfly-go
Dromara
6.3
1%
Sep 17Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
CVE-2026-92992
MA
mayfly-go
Dromara
6.3
0%
Sep 17Dromara mayfly-go AI Assistant ai.go authorization
CVE-2026-91996
LA
lamp-cloud
dromara
7.5
0%
Sep 15lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
CVE-2026-91993
JP
Jpom
dromara
4.3
0%
Sep 15Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
CVE-2026-90510
OR
orion-visor
dromara
8.3
0%
Sep 13dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
CVE-2026-90509
OR
orion-visor
dromara
7.3
0%
Sep 13dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
CVE-2026-77795
RU
RuoYi-Vue-Plus
Dromara
6.3
0%
Aug 21Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
CVE-2026-19758
LA
lamp-cloud
dromara
7.3
1%
Aug 13dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
CVE-2026-19757
LA
lamp-cloud
Dromara
7.3
1%
Aug 13Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
CVE-2026-19756
LA
lamp-cloud
Dromara
6.3
0%
Aug 13Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal
CVE-2026-69102
MA
MaxKey
dromara
9.8
1%
Aug 11MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
CVE-2026-69100
LA
lamp-cloud
dromara
8.8
1%
Aug 4LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
CVE-2026-67345
MA
MaxKey
dromara
8.1
1%
Jul 30MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
CVE-2026-58176
RU
RuoYi-Vue-Plus
dromara
6.5
0%
Jun 30RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
CVE-2026-9498
LA
lamp-cloud
Dromara
6.3
0%
May 25Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
CVE-2026-7699
MA
MaxKey
Dromara
6.3
0%
May 3Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
CVE-2026-6125
WA
warm-flow
Dromara
6.3
0%
Apr 12Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
CVE-2026-5529
LA
lamp-cloud
Dromara
4.3
0%
Apr 5Dromara lamp-cloud DefUserController pageUser improper authorization
CVE-2026-2819
RU
RuoYi-Vue-Plus
Dromara
6.3
0%
Feb 20Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization
CVE-2025-66916
RU
Ruoyi-vue-plus
Dromara
9.4
1%
Jan 8The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter…
CVE-2025-15222
SA
Sa-Token
Dromara
5.0
0%
Dec 30Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization
CVE-2025-15117
SA
Sa-Token
Dromara
3.1
0%
Dec 28Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization
CVE-2025-13268
DA
dataCompare
Dromara
6.3
0%
Nov 17Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
CVE-2025-7552
NO
Northstar
Dromara
6.3
0%
Jul 13Dromara Northstar Path AuthorizationInterceptor.java preHandle access control
CVE-2025-6925
RU
RuoYi-Vue-Plus
Dromara
9.1
1%
Jun 30Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
CVE-2025-6517
MA
MaxKey
Dromara
9.8
1%
Jun 23Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
CVE-2023-44794
SA
Sa-token
Dromara
9.8
1%
Oct 25An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL
CVE-2023-43961
SA
Sa-token
Dromara
8.8
1%
Oct 25An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2023-31581
SU
Sureness
Dromara
9.8
1%
Oct 25Dromara Sureness before v1.0.8 was discovered to use a hardcoded key
CVE-2023-3276
HU
Hutool
Dromara
7.5
1%
Jun 15A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19