12
CVEs
0
Critical
4
High
0
KEV
11
PoC
1
Unpatched C/H
33.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
3
LOW
5
Monthly CVE Trend
Affected Products (12)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-69100 | Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system. | HIGH | 8.7 | 0.6% | 64 |
PoC
|
| CVE-2026-91996 | Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/**) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. Exploit code is publicly available (a writeup and proof-of-concept are linked from the CVE references and VulnCheck advisory), and the flaw has not been listed in CISA KEV, so it is a high-value reconnaissance and credential-harvesting primitive rather than a confirmed mass-exploitation event. | HIGH | 8.7 | – | 64 |
PoC
No patch
|
| CVE-2026-67345 | OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV). | HIGH | 8.5 | 0.3% | 62 |
PoC
|
| CVE-2026-58176 | Broken function-level authorization in RuoYi-Vue-Plus through 5.6.2 allows any authenticated low-privileged user to manipulate workflow approval tasks - including reassigning pending approvals to arbitrary users, urging tasks, and enumerating all pending and completed tasks - by exploiting the absence of permission annotations on FlwTaskController endpoints under /workflow/task. This directly defeats segregation of duties in organizational approval chains, enabling a standard user to redirect approvals meant for specific roles and potentially approve transactions or actions they should never have authority over. A publicly available exploit is referenced in the project's GitHub issue tracker; no CISA KEV listing has been confirmed at time of analysis, suggesting targeted rather than widespread exploitation. | HIGH | 7.1 | 0.3% | 56 |
PoC
|
| CVE-2026-90510 | Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-91993 | Jpom through 2.11.12 exposes a broken object-level authorization flaw on the /build/branch-list endpoint, letting any authenticated user supply a repositoryId belonging to a different workspace and have the server resolve it without verifying ownership. This enables cross-workspace repository enumeration, disclosure of repository type, and execution of git ls-remote calls that reuse another workspace's stored Git credentials, leaking private repository metadata. Exploitation is low-complexity over the network with only a low-privileged account required, and publicly available exploit code exists, though the CVSS 4.0 base score is only 5.3 because the impact is limited to confidentiality. | MEDIUM | 5.3 | – | 46 |
PoC
No patch
|
| CVE-2026-6125 | Remote code injection in Dromara warm-flow up to version 1.8.4 allows authenticated attackers to execute arbitrary code through the SpelHelper.parseExpression function via manipulation of listenerPath, skipCondition, or permissionFlag parameters in the Workflow Definition Handler. The vulnerability uses SpEL (Spring Expression Language) injection to achieve code execution with CVSS 6.3 severity. Publicly available exploit code exists and the flaw has been documented in the project's issue tracker. | LOW | 2.1 | 0.0% | 31 |
PoC
|
| CVE-2026-9498 | Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-7699 | SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the filtersfields argument in the StrUtils.checkSqlInjection function, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires low-privilege authentication and has publicly available exploit code; the vendor has not responded to early disclosure notifications. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-5529 | Improper authorization in Dromara lamp-cloud up to version 5.8.1 allows authenticated remote attackers to bypass access controls in the DefUserController pageUser endpoint, gaining unauthorized read access to sensitive user information. The CVSS score of 4.3 reflects low confidentiality impact with network accessibility and low attack complexity; however, public exploit code availability and vendor non-responsiveness increase real-world risk despite the modest base score. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-78140 | Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|
| CVE-2026-77795 | Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|