Read the docs

YunaiV

Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

YunaiV records in CISA KEV

No YunaiV vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ruoyi-vue-pro 10 records MEDIUM Yudao-cloud 3 records MEDIUM

Records

33 records

TI-2026-11453 CVE-2026-13528 · GHSA-6q7h-qg7r-3g9c

Path traversal in YunaiV ruoyi-vue-pro

Priority HIGH 70

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00648 Published 2026-06-29 No fix listed CWE-22
TI-2026-04492 CVE-2026-5147 · GHSA-r78c-v88p-w43h

YunaiV yudao-cloud get-by-website sql injection

Priority HIGH 70

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00347 Published 2026-03-30 No fix listed CWE-74
TI-2026-80085 CVE-2026-116016 · GHSA-g4h2-v8gg-9pg9

Authorization bypass in yudao-cloud lets users evade data scope

Priority MEDIUM 64

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00254 Published 2026-10-24 No fix listed CWE-807
TI-2026-42058 CVE-2026-58448 · GHSA-f6rh-2m88-w48m

yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API

Priority MEDIUM 64

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instanc…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-30 Fixed in 2026.06 CWE-862
TI-2025-09431 CVE-2025-10276 · GHSA-2w47-9873-w85f

YunaiV ruoyi-vue-pro transfer improper authorization

Priority MEDIUM 59

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00306 Published 2025-09-12 No fix listed CWE-266
TI-2026-74104 CVE-2026-110610 · GHSA-v372-v7rj-cgvj

Server-side request forgery in ruoyi-vue-pro via Midjourney referImageUrl

Priority MEDIUM 57

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl t…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-14 No fix listed CWE-918
TI-2026-64034 CVE-2026-97321 · GHSA-286g-p8ff-85fj

Injection in YunaiV ruoyi-vue-pro

Priority MEDIUM 57

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00233 Published 2026-09-24 No fix listed CWE-74
TI-2026-64033 CVE-2026-97320 · GHSA-228m-p28v-qwvj

Server-side request forgery in YunaiV ruoyi-vue-pro

Priority MEDIUM 57

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2026-09-24 No fix listed CWE-918
TI-2025-09432 CVE-2025-10277 · GHSA-69f2-6mjq-5xcx

YunaiV yudao-cloud submit improper authorization

Priority MEDIUM 57

A vulnerability was detected in YunaiV yudao-cloud up to 2025.09.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00311 Published 2025-09-12 No fix listed CWE-266
TI-2025-09430 CVE-2025-10275 · GHSA-4vcj-8cj2-68x6

YunaiV yudao-cloud transfer improper authorization

Priority MEDIUM 57

A weakness has been identified in YunaiV yudao-cloud up to 2025.09.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00303 Published 2025-09-12 No fix listed CWE-266
Load more
Open these records in search →