YU
Vendor
YunaiV
26
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116007 New | RU ruoyi-vue-pro YunaiV | 3.7 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication |
| CVE-2026-116006 New | RU ruoyi-vue-pro YunaiV | 7.3 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication |
| CVE-2026-116016 New | YU yudao-cloud YunaiV | 7.1 | Oct 24 | yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header |
| CVE-2026-116015 New | YU yudao-cloud YunaiV | 4.3 | Oct 24 | yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint |
| CVE-2026-110610 | RU ruoyi-vue-pro YunaiV | 5.4 | Oct 14 | ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl |
| CVE-2026-97325 | RU ruoyi-vue-pro YunaiV | 4.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect |
| CVE-2026-97324 | RU ruoyi-vue-pro YunaiV | 7.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization |
| CVE-2026-97323 | RU ruoyi-vue-pro YunaiV | 6.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal |
| CVE-2026-97322 | RU ruoyi-vue-pro YunaiV | 4.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting |
| CVE-2026-97321 | RU ruoyi-vue-pro YunaiV | 6.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection |
| CVE-2026-97320 | RU ruoyi-vue-pro YunaiV | 6.3 | Sep 24 | YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery |
| CVE-2026-58448 | YU yudao-cloud YunaiV | 6.5 | Jun 30 | yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API |
| CVE-2026-13528 | RU ruoyi-vue-pro YunaiV | 7.3 | Jun 29 | YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal |
| CVE-2026-9464 | YU yudao-cloud YunaiV | 4.7 | May 25 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery |
| CVE-2026-7710 | YU yudao-cloud YunaiV | 7.3 | May 3 | YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication |
| CVE-2026-7679 | YU yudao-cloud YunaiV | 7.3 | May 3 | YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication |
| CVE-2026-7678 | YU yudao-cloud YunaiV | 6.3 | May 3 | YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection |
| CVE-2026-5148 | YU yudao-cloud YunaiV | 4.7 | Mar 30 | YunaiV yudao-cloud page sql injection |
| CVE-2026-5147 | YU yudao-cloud YunaiV | 7.3 | Mar 30 | YunaiV yudao-cloud get-by-website sql injection |
| CVE-2025-15098 | YU yudao-cloud YunaiV | 6.3 | Dec 26 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery |
| CVE-2025-10988 | RU ruoyi-vue-pro YunaiV | 8.8 | Sep 26 | YunaiV ruoyi-vue-pro transfer improper authorization |
| CVE-2025-10987 | YU yudao-cloud YunaiV | 8.8 | Sep 26 | YunaiV yudao-cloud HTTP Request transfer improper authorization |
| CVE-2025-10278 | RU ruoyi-vue-pro YunaiV | 8.8 | Sep 12 | YunaiV ruoyi-vue-pro transfer improper authorization |
| CVE-2025-10277 | YU yudao-cloud YunaiV | 8.8 | Sep 12 | YunaiV yudao-cloud submit improper authorization |
| CVE-2025-10276 | RU ruoyi-vue-pro YunaiV | 8.8 | Sep 12 | YunaiV ruoyi-vue-pro transfer improper authorization |
| CVE-2025-10275 | YU yudao-cloud YunaiV | 8.8 | Sep 12 | YunaiV yudao-cloud transfer improper authorization |