Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 2.9 | CVE-2026-116007 |
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
YunaiV, zhijiantianya, YunaiV / zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro, YunaiV / zhijiantianya ruoyi-vue-pro
|
NVD | |||
|
CVE-2026-116007A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
Executive summaryThe advisory reports that the YunaiV ruoyi-vue-pro (Yudao) project, up to version 2026.09, lets an unauthenticated attacker guess SMS verification codes without any attempt limit, which can lead to takeover of an account such as the built-in administrator. The advisory rates it Critical with a CVSS 3.1 score of 9.8, as stated by the reporter. The advisory states no fixed version exists as of 2026-09-21, and its remediation advice is to add failed-attempt counting and lockout to code verification. Technical summaryThe weakness is improper restriction of excessive authentication attempts (CWE-307, CWE-799, CWE-287) in the SMS verification code check, which keeps no failed-attempt counter, lockout, or rate limit. The attack needs only network access to the backend API and the target's mobile number, with no authentication and no user interaction; the advisory states the built-in admin's mobile number is published in the seed SQL. The advisory reports that POST /admin-api/system/auth/sms-login and POST /admin-api/system/auth/reset-password both accept a correct code, and that the login scene (scene=21) needs no CAPTCHA. Affected branches are listed as master, master-jdk17, and master-jdk25, with verified version master-jdk17 @ 7cab3a7; the fixed version is stated as none as of 2026-09-21. A workaround is not stated beyond the remediation suggestions, and no detection guidance is given beyond the advisory's suggestion to alert on abnormal verification volume per mobile and IP. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/63e3a697e…ffd41c1cbfdbb1fcd5b4 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYunaiVzhijiantianyaYunaiV / zhijiantianyaYunaiV ruoyi-vue-prozhijiantianya ruoyi-vue-proYunaiV / zhijiantianya ruoyi-vue-pro
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.5 | CVE-2026-116006 |
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
YunaiV, zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro
|
NVD | |||
|
CVE-2026-116006A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
Executive summaryA vulnerability was reported in the ruoyi-vue-pro project from YunaiV and zhijiantianya, affecting versions up to 2026.09. The advisory says an attacker can log in as any account whose mobile number they know, including the built-in administrator, without a password or verification. The advisory does not state a vendor recommendation or a fix; it says no fixed version was available as of 2026-10-21. Technical summaryThe weakness is a predictable SMS verification code (CWE-1188, CWE-798, CWE-640) caused by begin-code and end-code both being set to 9999 in the base application.yaml, so every SMS login code is 9999. An unauthenticated attacker calls send-sms-code with scene 21 and then sms-login with code 9999 to receive a full access token, with no CAPTCHA or user interaction required. The advisory gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with score 9.1. Affected branches are master, master-jdk17 and master-jdk25, and the fixed version is stated as none as of 2026-10-21. No workaround beyond overriding the begin-code and end-code values is explicitly stated as a vendor recommendation, and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/1ad8a1f16…7cb85c498473753a8636 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYunaiVzhijiantianyaYunaiV ruoyi-vue-prozhijiantianya ruoyi-vue-pro
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-110610 |
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch...
YunaiVYunaiV ruoyi-vue-pro
|
NVD | |||
|
CVE-2026-110610ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch...
From the advisoryruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||