Dromara vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20236
3. 20245
4. 20258
5. 202642

Newest CVEs

• CVE-2026-121552

  domain-admin before 1.6.79 Missing Authorization via getGroupUserList

  dromara · domain-admin

  Medium5.3
• CVE-2026-120461

  Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

  dromara · Jpom

  High8.7
• CVE-2026-120460

  Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

  dromara · Jpom

  High8.7
• CVE-2026-120201

  Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

  dromara · Jpom

  Critical9.3
• CVE-2026-119647

  RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}

  dromara · RuoYi-Vue-Plus

  Medium5.3
• CVE-2026-111605

  Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

  dromara · Jpom

  High8.6
• CVE-2026-110609

  Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

  dromara · skyeye

  High7.1
• CVE-2026-110107

  RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

  dromara · RuoYi-Cloud-Plus

  Low2.3
• CVE-2026-110106

  RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

  dromara · RuoYi-Vue-Plus

  Low2.3
• CVE-2026-109168

  lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId

  dromara · lamp-cloud

  High7.1