[ Vendor · 9 CVEs ]
dromara
CVEs affecting dromara published in the last 30 days, plus any dromara CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111605 | 16 Oct 2026 | CVSS 8.1 | dromara JpomJpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH… | |
| CVE-2026-110609 | 14 Oct 2026 | CVSS 6.5 | dromara skyeyeDromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via… | |
| CVE-2026-110106 | 13 Oct 2026 | CVSS 4.2 | dromara RuoYi-Vue-PlusRuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social… | |
| CVE-2026-110107 | 13 Oct 2026 | CVSS 4.2 | dromara RuoYi-Cloud-PlusRuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users'… | |
| CVE-2026-109166 | 12 Oct 2026 | CVSS 6.5 | dromara lamp-cloudlamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other… | |
| CVE-2026-109168 | 12 Oct 2026 | CVSS 6.5 | dromara lamp-cloudlamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects'… | |
| CVE-2026-107781 | 8 Oct 2026 | CVSS 7.4 | dromara skyeyeDromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability… | |
| CVE-2026-107779 | 8 Oct 2026 | CVSS 9.8 | dromara skyeyeDromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin… | |
| CVE-2026-107780 | 8 Oct 2026 | CVSS 9.8 | dromara skyeyeDromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated… |