D
Vendor security profile
dromara
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs27
Critical4
CISA KEV0
Public exploit18
Patch rate%19
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
7
12
7
CVE KEV
CVE severity distribution
27toplam CVE
Critical4 (15%)
High7 (26%)
Medium14 (52%)
Low2 (7%)
Patch and exploitation view
%19
Verified patch
%0
CISA KEV
%67
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
22Unknown
Latest vulnerabilities
2.3
CVE-2026-110107
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
D
Patch status unknown
2.3
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
D
Patch status unknown
7.1
CVE-2026-109168
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
D
Patch status unknownEPSS %0
7.1
CVE-2026-109166
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
D
Patch status unknownEPSS %0
9.1
CVE-2026-107781
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
D
Patch status unknownEPSS %0
9.3
CVE-2026-107780
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
D
Patch status unknownEPSS %2
9.3
CVE-2026-107779
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
D
Patch status unknownEPSS %1
4.3
CVE-2026-94536
lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
D
Patch status unknownEPSS %0
7.1
CVE-2026-94535
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
D
Patch status unknownEPSS %0
7.1
CVE-2026-94534
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
D
Patch status unknownEPSS %0