CVEs we hold for Dromara

Records whose assigning authority named Dromara as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-9498Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engineDromara lamp-cloud

CVE-2026-92993Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injectionDromara mayfly-go

CVE-2026-92992Dromara mayfly-go AI Assistant ai.go authorizationDromara mayfly-go

CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpointdromara lamp-cloud

CVE-2026-91993Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-listdromara Jpom

CVE-2026-90510dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keydromara orion-visor

CVE-2026-90509dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsdromara orion-visor

CVE-2026-78140Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineDromara UJCMS

CVE-2026-77795Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorizationDromara RuoYi-Vue-Plus

CVE-2026-7699Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injectionDromara MaxKey

CVE-2026-69102MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trustdromara MaxKey

CVE-2026-69100LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Executiondromara lamp-cloud

CVE-2026-67345MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theftdromara MaxKey

CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionDromara warm-flow

CVE-2026-58176RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpointsdromara RuoYi-Vue-Plus

CVE-2026-5529Dromara lamp-cloud DefUserController pageUser improper authorizationDromara lamp-cloud

CVE-2026-2954Dromara UJCMS ImportDataController import-channel importChanel injectionDromara UJCMS

CVE-2026-2953Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalDromara UJCMS

CVE-2026-2819Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorizationDromara RuoYi-Vue-Plus

CVE-2026-19758dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversaldromara lamp-cloud

CVE-2026-19757Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversalDromara lamp-cloud

CVE-2026-19756Dromara lamp-cloud Code Generator DefGenProjectController.java path traversalDromara lamp-cloud

CVE-2025-7552Dromara Northstar Path AuthorizationInterceptor.java preHandle access controlDromara Northstar

CVE-2025-6925Dromara RuoYi-Vue-Plus Mail MailController.java path traversalDromara RuoYi-Vue-Plus

CVE-2025-6517Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgeryDromara MaxKey

CVE-2025-2491Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingDromara ujcms

CVE-2025-2490Dromara ujcms File Upload WebFileUploadController.java upload cross site scriptingDromara ujcms

CVE-2025-15222Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserializationDromara Sa-Token

CVE-2025-15117Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserializationDromara Sa-Token

CVE-2025-13268Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injectionDromara dataCompare

CVE-2024-3928Dromara open-capacity-platform auth-server heapdump information disclosureDromara open-capacity-platform

CVE-2024-12483Dromara UJCMS User ID id authorizationDromara UJCMS

CVE-2023-51653Hertzbeat JMX JNDI RCEdromara hertzbeat

CVE-2023-51650Unauthorized access vulnerability on three interfacesdromara hertzbeat

CVE-2023-51389HertzBeat SnakeYAML Deser RCEdromara hertzbeat

CVE-2023-51388HertzBeat AviatorScript Inject RCEdromara hertzbeat

CVE-2023-51387Expression Injection Vulnerability in Hertzbeatdromara hertzbeat

CVE-2023-3276Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceDromara HuTool

CVE-2023-2476Dromara J2eeFAST Announcement cross site scriptingDromara J2eeFAST

CVE-2023-2475Dromara J2eeFAST System Message cross site scriptingDromara J2eeFAST

CVE-2022-4565Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumptionDromara HuTool

CVE-2022-39337Permission bypass due to incorrect configuration in github.com/dromara/hertzbeatdromara hertzbeat

42 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.