YunaiV has 19 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 11 in the last 90 days against 3 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-266 (4) and CWE-285 (4). Most affected products: ruoyi-vue-pro (11), yudao-cloud (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 11 prev 3
Worst active — by depth score
CVE-2026-116006High· 7.3YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication52CVE-2026-7710High· 7.3YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication52CVE-2026-7679High· 7.3YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication52CVE-2026-5147High· 7.3YunaiV yudao-cloud get-by-website sql injection52CVE-2026-97323Medium· 6.3A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.0847
YunaiV vulnerabilities
CVEs affecting YunaiV, newest first. Open any entry for full detail, references, and exploit status.
19 CVEsRSS
CVE-2026-116007Low· 3.7PoCYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. …
CVE-2026-116006High· 7.3PoCYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile…
CVE-2026-116015Medium· 4.3yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values.…
CVE-2026-116016High· 7.1yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header …
CVE-2026-110610Medium· 5.4PoCruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney …
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney …
CVE-2026-97324High· 7.3A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderCon…
CVE-2026-97325Medium· 4.3PoCA security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/syste…
CVE-2026-97323Medium· 6.3PoCA vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl…
CVE-2026-97322Medium· 4.3A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the c…
CVE-2026-97320Medium· 6.3PoCA flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. …
CVE-2026-97321Medium· 6.3PoCA vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/serv…
CVE-2026-7679High· 7.3PoCYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. P…
CVE-2026-7678Medium· 6.3PoCYunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulatio…
CVE-2026-7710High· 7.3PoCYunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument moc…
CVE-2026-5147High· 7.3PoCYunaiV yudao-cloud get-by-website sql injection
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible …
CVE-2025-15098Medium· 6.3PoCA vulnerability was determined in YunaiV yudao-cloud up to 2025.11
A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing manipulation of the argument url/heade…
CVE-2025-10278Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to…
CVE-2025-10276Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorizat…
CVE-2025-10275Medium· 6.3PoCYunaiV yudao-cloud transfer improper authorization
A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The atta…