dromara vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-111605 Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belongingHigh 8.6 · Oct 16, 2026
• CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword High 7.1 · Oct 14, 2026
• CVE-2026-109168 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachHigh 7.1 · Oct 12, 2026
• CVE-2026-109166 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' filHigh 7.1 · Oct 12, 2026
• CVE-2026-107781 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlCritical 9.1 · Oct 8, 2026
• CVE-2026-107780 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsControllerCritical 9.3 · Oct 8, 2026
• CVE-2026-107779 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoControlleCritical 9.3 · Oct 8, 2026
• CVE-2026-94535 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' nHigh 7.1 · Sep 21, 2026
• CVE-2026-94534 lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify aHigh 7.1 · Sep 21, 2026
• CVE-2026-94533 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachmenHigh 7.1 · Sep 21, 2026
• CVE-2026-94532 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user'High 7.1 · Sep 21, 2026
• CVE-2026-91996 lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system pHigh 8.7 · Sep 15, 2026
• CVE-2026-69102 MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackeCritical 9.3 · Aug 11, 2026
• CVE-2026-69100 LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed High 8.7 · Aug 4, 2026
• CVE-2026-67345 MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allHigh 8.5 · Jul 30, 2026
• CVE-2026-58176 RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permissioHigh 7.1 · Jun 30, 2026
• CVE-2025-66916 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but Critical 9.4 · Jan 8, 2026
• CVE-2024-33153 J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.Critical 9.8 · May 7, 2024
• CVE-2023-51653 Hertzbeat is a real-time monitoring system.Critical 9.8 · Feb 22, 2024
• CVE-2023-51389 Hertzbeat is a real-time monitoring system.Critical 9.8 · Feb 22, 2024
• CVE-2023-51388 Hertzbeat is a real-time monitoring system.Critical 9.8 · Feb 22, 2024
• CVE-2023-51650 Hertzbeat is an open source, real-time monitoring system.High 7.5 · Dec 22, 2023
• CVE-2023-51387 Hertzbeat is an open source, real-time monitoring system.High 7.2 · Dec 22, 2023
• CVE-2022-39337 Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless.High 7.5 · Dec 22, 2023
• CVE-2023-44794 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.Critical 9.8 · Oct 25, 2023